Outlook Zero-Day with CVSS 6.5 Is the Only Actively Exploited Flaw in 1,094-CVE Patch Tuesday

Microsoft fixed 1,094 vulnerabilities in November 2026; the sole confirmed actively exploited zero-day carries a Moderate CVSS 6.5 rating and leaks NTLMv2 hashes via crafted Outlook message files.

Microsoft released its November 2026 Patch Tuesday with 1,094 vulnerabilities fixed. Among them, 63 are rated Critical and one is rated Moderate: CVE-2026-124194. That Moderate flaw is also the only zero-day confirmed as actively exploited in the release. The case underscores a familiar tension for security teams: CVSS score does not necessarily dictate operational priority.

Key Takeaways

Microsoft fixed 1,094 CVEs in the November 2026 Patch Tuesday, with 726 in Windows and 174 in Office.
CVE-2026-124194 is the only zero-day confirmed as actively exploited, carrying CVSS 6.5 and a Moderate rating.
The vector requires a user to open a crafted message file in Outlook; the Preview Pane is explicitly excluded.
CISA added the vulnerability to the KEV catalog on November 10, 2026, with a federal remediation deadline of November 24, 2026.

The Mechanism: NTLMv2 Leak Without Warning

The vulnerability lies in how Outlook handles specially crafted message files. When the user opens the document, the application connects to an attacker-controlled network resource without displaying the standard external-content warning.

The Microsoft Security Response Center describes the sequence: opening the file "could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user." The exposed data is the user's NTLMv2 hash. According to the same advisory, "this vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user."

User interaction is required: the victim must open the file. Microsoft has explicitly ruled out the Preview Pane as an attack vector, with a FAQ stating: "No, the Preview Pane is not an attack vector."

"For the third month running, the bug attackers actually use carries a rating below Critical" — Shattered.io

Affected Products and Fix Builds

The affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The builds that remediate the vulnerability are 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024, per CVE Security and Automox records.

An unresolved tension persists around Office LTSC 2021. Its end-of-support date of October 13, 2026 has already passed, yet the product appears in the list of patched versions. Sources do not reconcile the end-of-support date with the product's presence in the patched-versions list. Microsoft has not clarified the point.

CISA KEV and the 14-Day Window

Inclusion in CISA's Known Exploited Vulnerabilities catalog occurred on November 10, 2026, the same day as the Microsoft release. The deadline imposed on federal agencies is November 24, 2026: 14 days for remediation.

The mandate stems from Binding Operational Directive 26-04, the mechanism by which CISA enforces operational priorities across the U.S. federal government. The 14-day window reflects the perceived severity of active exploitation, independent of the CVSS score.

Analysis: The Misalignment Between CVSS and Active Exploit

CVE-2026-124194 documents a recurring pattern. Automox summarizes the misalignment: "The score stays low because nothing executes, but a working hash is a working login." The CVSS 6.5 reflects the absence of remote code execution and the requirement for user interaction, but it does not capture the operational consequence of an NTLMv2 hash in an attacker's hands.

Shattered.io observed that for the third consecutive month the threat actually exploited carries a rating below the maximum. In October 2026, the record 1,413-CVE release saw no Critical zero-days, and the pattern repeats in November.

CVSS measures the intrinsic severity of a flaw, not the likelihood of offensive use or its value to an attacker. An NTLMv2 hash does not execute code, but it can be used to authenticate as the user. The distinction between theoretical metric and operational impact is documented, not interpretive.

What to Do Now

Primary sources indicate that security teams must update Office separately from Windows Update: the Outlook zero-day is not covered by the OS cumulative update. The specific fix builds are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024.

The CISA deadline for U.S. federal agencies is November 24, 2026. For other environments, priority derives from the confirmed exploitation status, not the CVSS score.

Microsoft has not detected public pre-patch disclosure for this vulnerability. The identity of the attackers, specific exploitation campaigns, and the geographic or sectoral scope of observed attacks are not documented in available sources.

Context: Record Volumes in 2026

The November 2026 Patch Tuesday sits in a year of exceptional volumes. Microsoft has fixed more than 5,000 vulnerabilities in 2026. The previous month, October 2026, set an all-time record with 1,413 CVEs in a single release.

The November product breakdown: 726 CVEs in Windows, 174 in Office, 59 in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, 9 in Exchange Server.

Discovery of CVE-2026-124194 is credited to Benoît Sevens, with mention of Anthropic's Claude as a tool, and to researcher "nono." Microsoft cites the tool in the acknowledgment but does not provide details on the full identification methodology.

Sources

Sources and references

Get DeafLetter