Microsoft Rated the Exploited Outlook Zero-Day Moderate, the Lowest Severity in 1,093 Fixes

Most patch programs start the same way every second Tuesday: export the release, sort by severity, and work down from Critical until the maintenance window runs out. November's release shows where that habit breaks. Of the 1,093 Microsoft vulnerabilities fixed on November 10, exactly one carried a Moderate rating, and it was the one Microsoft says attackers were already using. It is an Outlook flaw that turns one opened file into a stolen credential, and on paper it ranks below more than a thousand bugs nobody has been seen exploiting.

A 6.5 That Hands Over a Credential

Microsoft classes CVE-2026-124194 as a spoofing vulnerability. According to CSO Online, the victim has to open a malicious file, after which Outlook connects to an attacker-controlled network location without showing its normal external-content warning, and in doing so leaks the user's NTLMv2 password hash. The attacker can then relay that hash to sign in as the user or crack it offline to recover the password itself. Nick Carroll of Nightwing told the publication not to let the low score fool defenders.

The scoring explains why the number looks tame. GBHackers lays out the CVSS 3.1 vector: network attack, low complexity, no privileges, user interaction required, and high impact on confidentiality only, with no integrity or availability impact. Those last two zeros cap the base score at 6.5. The temporal metrics tell a different story, marking exploit maturity as high and the report as confirmed. GBHackers maps the weakness to CWE-356, a user interface that does not warn of unsafe actions, and stresses that because the target must open the file, this is not a zero-click attack. Notebookcheck adds that the Preview Pane is not an attack vector, so the file has to be opened.

None of that makes the outcome small. A captured hash is not a plaintext password, but it is a working credential wherever NTLM is still accepted, and a relayed authentication carries the user's own rights. Microsoft has not published details of the attacks, so defenders do not know who was targeted or what the hashes were used for.

Severity Sorting Puts It at the Bottom

Tenable's breakdown of the release counts 1,093 CVEs across 287 products and components: 63 Critical, 1,029 Important, one Moderate and none rated Low. Elevation of privilege made up 48.9% of the total and remote code execution 27.1%. Other counts differ slightly, with CSO Online and SecurityWeek reporting 1,094, but the shape is the same. Any team that triages by vendor severity alone has 1,092 entries ranked above the only one Microsoft flagged as exploited in Outlook.

The volume itself is new. Notebookcheck, citing SecurityWeek, says October set a record with 1,413 fixes, and notes Brian Krebs's observation that a year ago Microsoft averaged about 100 patches a month, an increase Microsoft attributes to advances in AI. CSO Online quotes Dustin Childs of TrendAI ZDI urging defenders to stop broad triage and take immediate defensive action. At more than a thousand fixes a month, "patch everything Critical first" is no longer a plan that reliably reaches the flaws attackers are using.

An AI-Assisted Find, Already in the Wild

The credit line has drawn as much attention as the bug. Notebookcheck reports that Microsoft's advisory credits a researcher known as "nono" and Benoît Sevens, and that Sevens' acknowledgment reads "using Claude with Anthropic." Tenable notes the advisory does not say which Claude version was involved. Satyam Narang of Tenable told CSO Online that AI has been "building bigger haystacks across Patch Tuesday releases," and that this is the first time it has found a needle. The advisory does not say whether the flaw was spotted during an attack in progress, so how long it was exploited before the report remains unknown.

The affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Notebookcheck lists the fixed builds as 16.0.17932.21140 for LTSC 2024 and 16.0.14334.21048 for LTSC 2021. Office 2016 and 2019 are not listed, and neither has received security updates since October 2025, which means any machine still running them is outside the advisory altogether rather than safely out of scope.

What to Do This Week

• Pull CVE-2026-124194 to the top of the queue. Treat Microsoft's own exploitation flag as outranking any severity label, and confirm Office clients actually reached the fixed builds rather than assuming automatic updates landed.
• Re-sort the whole release by exploitation. Rank this month's fixes by known exploitation and exposure first, then by CVSS, so a 6.5 that is under attack is never scheduled behind a 9.8 that is not.
• Block outbound SMB at the perimeter. GBHackers recommends blocking unnecessary outbound SMB connections, which stops a workstation from offering its hash to a server on the internet in the first place.
• Enforce SMB signing and shrink NTLM. Signing defeats many relay attempts, and every service moved off NTLM is one where a stolen hash no longer opens a door.
• Hunt for unexpected external authentication. Review logs for workstations authenticating to unfamiliar outside hosts since early November, and reset credentials for any user whose machine did.
• Find the Office 2016 and 2019 stragglers. They receive no fixes, so inventory them, isolate them from mail where possible, and put retirement on a date rather than a wish list.

Until patches are confirmed everywhere, Notebookcheck's advice is simple: do not open message files or Office documents from unexpected emails, even from senders that look familiar, and CSO Online adds awareness training and a capable email gateway. Those measures buy time. The lasting fix is a triage process that reads Microsoft's exploitation flag before its severity column, because this month the two pointed in opposite directions.