Summary

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. Microsoft’s November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited. The zero-day, tracked as CVE-2026-124194 , has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place. Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5.

AI summaries can be wrong sometimes—always verify important details using the source article.