Microsoft released its November 2026 security updates on 10 November 2026 at 08:00 US Pacific time (00:00 AWST 11 November).

In Microsoft's Security Update Guide, one flaw in the release is marked exploited: CVE-2026-124194, a Microsoft Office Outlook spoofing vulnerability.

Microsoft says the Outlook user interface does not warn the user of unsafe actions, which allows an unauthorized attacker to perform spoofing over a network; it rates the flaw Moderate, CVSS 6.5, with user interaction required, and marks it 'Exploitation Detected'.

Microsoft does not mark it as publicly disclosed and does not say who reported it or how it was used. The Security Update Guide lists 1,093 Microsoft-issued CVEs released on 10 November: 63 Critical (48 remote code execution, 15 elevation of privilege), 1,029 Important and 1 Moderate. Critical remote code execution flaws rated CVSS 9.8 by Microsoft include Windows LDAP (CVE-2026-119958) and Windows Search (CVE-2026-116928), both rated 'Exploitation Less Likely'.

Microsoft rates 42 flaws 'Exploitation More Likely', among them Microsoft Exchange Server, Windows Active Directory Domain Services and Windows Schannel remote code execution bugs. (source: Microsoft Security Update Guide)

UPDATE (11 Nov 2026, Perth): CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on 10 November 2026 ('Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability', CWE-356); the US federal due date is 24 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)