Vulnerability · medium · CVSS 6.5
Microsoft November 2026 Patch Tuesday fixes over 1,000 flaws including exploited Outlook zero-day
Tier A · Patch today – Before you go home
Who’s exposed: Organisations running Microsoft Outlook and Windows
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild
What to do
- Install the November 2026 Patch Tuesday updates, prioritising the Outlook fix for CVE-2026-124194
- Windows 10 systems enrolled in extended security updates can install KB5131096
The Brief
- Microsoft's November 2026 Patch Tuesday fixed more than 1,000 flaws; source counts vary from 1,093 (The Record) to 1,260 (SANS).
- Microsoft says it is aware of active exploitation of Outlook zero-day CVE-2026-124194.
- SANS reports 68 of the vulnerabilities are critical and 167 are Chromium issues affecting Microsoft Edge.
- Windows 10 extended security update KB5131096 includes the November 2026 fixes plus a few bug fixes and changes.
Why it matters
The exploited Outlook zero-day makes this update a priority for anyone running Outlook. The sheer volume of fixes also means teams need to plan testing and deployment for a large patch batch.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Windows, Outlook and Edge are platforms developers and IT teams run and support daily. |
| No | Core infrastructure | Judgment: Windows and Outlook are not in the core infrastructure list such as OpenSSH, Linux kernel or GitHub. |
| Yes | Popular tool | Judgment: Outlook and Windows are mainstream, widely deployed products used by many organisations. |
| Yes | Exploited in the wild | CISA SSVCCISA rates exploitation of CVE-2026-124194 as active |
| No | Public exploit | No source says exploit code or a proof-of-concept has been published. |
| No | Remote, no login | CVSSCVSS: CVE-2026-124194 AV:N/PR:N/UI:R |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | No source reports stolen credentials, tokens, keys, source code or customer data. |
| No | Supply chain | No source reports malicious code shipped through an official update or trusted channel. |
| No | No fix yet | The Record and BleepingComputer report that Microsoft's November 2026 Patch Tuesday patched the flaws. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-124194 ↗CVSS 6.5 medium AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
Microsoft Outlook Spoofing Vulnerability
- Exploited
- CISA rates exploitation active
- Weakness
- CWE-356
Timeline
Microsoft releases November 2026 Patch Tuesday fixes, including exploited Outlook zero-day
Windows 10 KB5131096 extended security update released
BleepingComputer
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
SANS Internet Storm Center, InfoCON: green
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
SecurityWeek
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
BleepingComputer
Microsoft releases Windows 10 KB5131096 extended security update
The Record from Recorded Future News
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
Full coverage · 5 sources
- 57 min ago ↗
The Record from Recorded Future News
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row - 2h ago ↗
BleepingComputer
Microsoft releases Windows 10 KB5131096 extended security update - 3h ago ↗
- 3h ago ↗
SANS Internet Storm Center, InfoCON: green
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th) - 3h ago ↗
First seen · 5 sources · Full story page · How tiers are decided