Report · Krebs on SecurityAbout CVE-2026-124194Published 10 Nov 2026

Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Affects Microsoft OfficeSource Krebs on Security

Authoritative record:CVE-2026-124194· Medium 6.5

Exploited in the wild · KEV due 24 Nov 2026 · public exploit available · fixed in 16.0.14334.21048 : patch Microsoft Office now.

Data as of 10 Nov 2026, 23:18 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none

CVSS scores by source
CNA (microsoft)	CVSS 3.1	6.5

KEV deadline: 24 Nov 2026 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
Patch: Available – fixed in 16.0.14334.21048, 16.0.17932.21140

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C

Base metrics

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Temporal metrics

Exploit Code Maturity: High
Remediation Level: Official Fix
Report Confidence: Confirmed

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.
Exploit Code Maturity: High: Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation, or is actively being delivered via an autonomous agent (such as a worm or virus). Network-connected systems are likely to encounter scanning or exploitation attempts. Exploit development has reached the level of reliable, widely-available, easy-to-use automated tools.
Remediation Level: Official Fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Report Confidence: Confirmed: Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 10 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
CVSS exploit maturity: proof of concept public
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Microsoft Corporation
6 Nov 202622:09 UTC, 4 days before disclosure
CVE published
on cve.org
10 Nov 202618:22 UTC, t = 0
In Threat Radar
record ingested
10 Nov 202618:35 UTC, 13 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
10 Nov 2026, the same day as disclosure
KEV remediation due
US federal deadline
24 Nov 2026, 14 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CVSS vector, CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Microsoft Office LTSC to 16.0.14334.21048 (2021) or 16.0.17932.21140 (2024).

Affected software

Product	Affected	Fixed in
MicrosoftMicrosoft 365 Apps for Enterprise	Affected =16.0.1	Fixed in–
MicrosoftMicrosoft Office LTSC 2021	Affected >=16.0.1 <16.0.14334.21048	Fixed in 16.0.14334.21048
MicrosoftMicrosoft Office LTSC 2024	Affected >=16.0.0 <16.0.17932.21140	Fixed in 16.0.17932.21140

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

Microsoft released a large Patch Tuesday update addressing 1,093 vulnerabilities, including 63 critical flaws affecting Windows and related software. Among these is a zero-day vulnerability (CVE-2026-124194) in Microsoft Outlook that is actively exploited. Nearly half of the critical bugs allow remote code execution, and many others enable privilege escalation. Other major vendors including Apple, Google, Mozilla, and Adobe also issued security updates this week. Microsoft credits AI advancements for the increased volume of identified and fixed vulnerabilities. The update is part of a continuous effort to mitigate risks from vulnerabilities actively exploited or potentially exploitable in the wild.

Impact

The vulnerabilities fixed include critical remote code execution flaws that could allow attackers to seize control of affected Windows systems with minimal user interaction. Privilege escalation vulnerabilities also enable attackers to gain higher system privileges. The actively exploited zero-day in Outlook increases risk for targeted attacks. The broad scope of patched vulnerabilities reduces the attack surface for adversaries. Other vendors' updates address similarly critical flaws in their products, enhancing security across multiple platforms. Failure to apply these updates could leave systems vulnerable to compromise.

Mitigation

Apply the Microsoft security updates released on November 10, 2026, to address the 1,093 vulnerabilities, including the actively exploited Outlook zero-day (CVE-2026-124194). Ensure all supported Microsoft 365 Apps for Enterprise and Office editions are updated promptly. Similarly, apply security updates from Apple, Google, Mozilla, and Adobe to mitigate vulnerabilities in their products. Back up important data before applying updates. Maintain a continuous patch management strategy focusing on known exploited vulnerabilities as recommended by CISA. No indication exists that these vulnerabilities are already mitigated or require no action.

Summary

On November 10, 2026, Microsoft released security updates fixing 1,093 vulnerabilities in Windows operating systems and supported software, including 63 critical flaws. These critical vulnerabilities include remote code execution and privilege escalation bugs. One zero-day vulnerability, CVE-2026-124194, a spoofing bug in Microsoft Outlook affecting Microsoft 365 Apps for Enterprise and Office editions, is confirmed to be actively exploited. This patch release is part of a broader ecosystem update with Apple, Google, Mozilla, and Adobe also addressing multiple security issues. Microsoft attributes the high volume of patches to AI-assisted vulnerability discovery. The update aims to reduce exposure to known exploited vulnerabilities and improve overall system security.

CWE-356Missing User Interaction for Potentially Unsafe Action (opens in a new tab)
Base weakness
The product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.
Architecture and Design
Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 22:06 UTC

WeaknessesCWE-356

References

Community reviews

Related threats