Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs.
With the latest round of fixes, Microsoft has addressed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable.
Of these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited by Microsoft.
“Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network,” Microsoft said in an advisory.
An unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Microsoft Outlook.
This, in turn, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information, such as an NTLMv2 hash, that could be used to impersonate the user.
Microsoft emphasized that successful exploitation requires network connectivity and user interaction. The tech giant credited a researcher named Nono and Anthropic’s Benoît Sevens (using Claude) with discovering and reporting the flaw.
“Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity,” Jack Bicer, director of vulnerability research at Action1, said. “A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach.”
“The Moderate label undersells this one. Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox.”
That said, Redmond has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited in the wild. The advisory also doesn’t spell out whether the discovery came before or after attackers began exploiting the flaw.
The development has prompted the U.S. U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fix by November 24, 2026.
Some other vulnerabilities of note include a number of remote code execution flaws impacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).
“Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,” Jake Knott, head of threat intelligence at watchTowr, said.
“Teams are really starting to feel the strain of working out ‘what actually matters?’ when there is fire after fire every day demanding immediate attention. Start with what you actually have exposed to the Internet, then what’s already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation.”
