Microsoft releases Patch Tuesday updates covering 1,259 vulnerabilities across its software portfolio. The most prominent is CVE-2026-124194, a Microsoft Outlook flaw that Microsoft says is actively exploited. When a user opens a specially crafted message file in affected Outlook versions, the client can connect to an attacker-controlled server and suppress the usual external-content warning.
Across sources, the key risk is that the outbound connection can expose authentication material, including an NTLMv2 hash, which attackers may use for user impersonation within a network. Dev.to emphasizes how the exploit can work with a single opened message and notes that the issue is listed in the U.S. CISA Known Exploited Vulnerabilities catalog, with a Nov. 24, 2026 remediation deadline for federal agencies. The Hacker News instead focuses on the breadth of the patch release and the overall distribution of vulnerabilities across products, including Windows and Office.
