Microsoft fixes 200 vulnerabilities, including an Outlook flaw CISA confirms is being exploited

What happened

CISA, the US cybersecurity agency, today added CVE-2026-124194 to its KEV catalogue of known exploited vulnerabilities, confirming that attackers are already using it. The flaw affects Microsoft Outlook and carries a CVSS score of 6.5: the program fails to warn users about unsafe actions, allowing an unauthenticated attacker to spoof content over a network. It requires the victim to interact, and its main impact is the exposure of information.

The flaw is part of a batch of 200 vulnerabilities Microsoft fixed on 10 November 2026. According to advisories from the Microsoft Security Response Center (MSRC), 21 are rated critical (CVSS 9.0 to 9.9), 178 are rated high (CVSS 8.8) and the Outlook flaw is rated medium. All data comes from the vendor; NVD, the US National Vulnerability Database, has not yet published these entries.

Exploitation status

Only CVE-2026-124194 has confirmed active exploitation. CISA has set 24 November 2026 as the fix deadline for US federal agencies, and it is not known whether the flaw has been used in ransomware campaigns. No public exploit is known, and three specialist outlets have covered the flaw over the past week.

There is no evidence of exploitation or public exploits for the rest, although several of the critical flaws can be attacked over the network without credentials or user interaction, which makes them attractive targets.

The most serious flaws

The critical vulnerabilities are concentrated in Windows network services, SharePoint, SQL Server, and cloud and developer services. The product tags on these entries are machine-inferred, so the reference point is the description in each Microsoft advisory.

• Windows network services, CVSS 9.8 and exploitable without authentication: remote code execution (RCE) in Windows DNS (CVE-2026-88218), Windows DHCP Server (CVE-2026-88243), LDAP, the directory access protocol (CVE-2026-119958), iSCSI, the network storage protocol (CVE-2026-88234) and the Windows Search component (CVE-2026-116928); plus an authentication bypass in Windows Kerberos that allows privilege escalation (CVE-2026-85844).
• Windows multimedia components, CVSS 9.8: buffer overflows in DirectMusic (CVE-2026-95882 and CVE-2026-95901) and Media Foundation (CVE-2026-96157) that allow arbitrary code execution.
• Xbox, CVSS 9.8: RCE in Xbox (CVE-2026-66801) and in the Windows Xbox Live Networking Service (CVE-2026-112967).
• SQL Server, CVSS 9.8: a heap-based buffer overflow that lets an unauthenticated attacker run code (CVE-2026-116945).
• SharePoint: privilege escalation through incorrect authorisation, CVSS 9.9 (CVE-2026-120002); two cross-site scripting (XSS) flaws, CVSS 9.0 (CVE-2026-109454 and CVE-2026-80095); and two deserialisation flaws, CVSS 8.8, that let an authenticated user run code (CVE-2026-109464 and CVE-2026-109472).
• Cloud and development: RCE in Azure DevOps, CVSS 9.9 (CVE-2026-109467); unauthenticated privilege escalation in Azure Managed Grafana (CVE-2026-114160) and Azure OpenAI (CVE-2026-119990), both CVSS 9.8; code injection in Visual Studio Code, CVSS 9.6 (CVE-2026-120779); and privilege escalation in Microsoft Graph, CVSS 9.1 (CVE-2026-114162), and ASP.NET Core, CVSS 9.0 (CVE-2026-114146).
• Other Windows flaws rated CVSS 8.8: iSCSI (CVE-2026-105518), Windows Storage (CVE-2026-105534), NTFS (CVE-2026-105542), Windows DNS (CVE-2026-109463), Remote Desktop Services (CVE-2026-108401) and a local privilege escalation in Desktop Window Manager (CVE-2026-105581).

Full list by product

The remaining vulnerabilities are all rated CVSS 8.8. Most are memory-safety bugs in Office (heap and stack buffer overflows, use-after-free, out-of-bounds reads and double frees) that allow code execution.

• Word: CVE-2026-109501, CVE-2026-109503, CVE-2026-109505, CVE-2026-110047, CVE-2026-110048, CVE-2026-110050, CVE-2026-110054, CVE-2026-110055, CVE-2026-110061, CVE-2026-110062, CVE-2026-110064, CVE-2026-110067, CVE-2026-111285, CVE-2026-111290, CVE-2026-111294, CVE-2026-111295, CVE-2026-111298, CVE-2026-111299, CVE-2026-111304, CVE-2026-111306, CVE-2026-111307, CVE-2026-111308, CVE-2026-111310, CVE-2026-112714, CVE-2026-112715, CVE-2026-112716, CVE-2026-112717, CVE-2026-112718, CVE-2026-112719, CVE-2026-112721, CVE-2026-112722, CVE-2026-112723, CVE-2026-112724, CVE-2026-112726, CVE-2026-112728, CVE-2026-112729, CVE-2026-112730, CVE-2026-112733, CVE-2026-112735, CVE-2026-112739, CVE-2026-112741, CVE-2026-116719, CVE-2026-116720, CVE-2026-116722, CVE-2026-116923, CVE-2026-116925, CVE-2026-123394.
• Excel: CVE-2026-116927, CVE-2026-118292, CVE-2026-118293, CVE-2026-118294, CVE-2026-118295, CVE-2026-118296, CVE-2026-118297, CVE-2026-118298, CVE-2026-118299, CVE-2026-118302, CVE-2026-118700, CVE-2026-118701, CVE-2026-118702, CVE-2026-118703, CVE-2026-118704, CVE-2026-118705, CVE-2026-118706, CVE-2026-118707, CVE-2026-118708, CVE-2026-118709, CVE-2026-118710, CVE-2026-118711, CVE-2026-118712, CVE-2026-118713, CVE-2026-118714, CVE-2026-118715, CVE-2026-118716, CVE-2026-118717, CVE-2026-118718, CVE-2026-118719, CVE-2026-118720, CVE-2026-118721, CVE-2026-118722, CVE-2026-118724, CVE-2026-118725, CVE-2026-118726, CVE-2026-118729, CVE-2026-118730, CVE-2026-118731, CVE-2026-118732, CVE-2026-119986, CVE-2026-120785, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789, CVE-2026-120790, CVE-2026-120791, CVE-2026-123385, CVE-2026-124174, CVE-2026-124176, CVE-2026-124187.
• Outlook: CVE-2026-110043, CVE-2026-110068, CVE-2026-111309, CVE-2026-123375, CVE-2026-123376, CVE-2026-123377, CVE-2026-123380, CVE-2026-123381, CVE-2026-123382, CVE-2026-123383, CVE-2026-123384.
• Access: CVE-2026-109493, CVE-2026-110058, CVE-2026-110059, CVE-2026-110060, CVE-2026-111301, CVE-2026-111305; Visio: CVE-2026-109494, CVE-2026-109496; PowerPoint: CVE-2026-112734, CVE-2026-112737, CVE-2026-120001, CVE-2026-120005; Office: CVE-2026-111289, CVE-2026-116717, CVE-2026-120003, CVE-2026-122198.
• SharePoint (deserialisation, SSRF, type confusion and incorrect authorisation): CVE-2026-109499, CVE-2026-109502, CVE-2026-110044, CVE-2026-123390, CVE-2026-123391.
• SQL Server (SQL injection, command injection and buffer overflows): CVE-2026-116930, CVE-2026-116934, CVE-2026-116941, CVE-2026-116942, CVE-2026-116946, CVE-2026-118105, CVE-2026-118109, CVE-2026-118110, CVE-2026-118120, CVE-2026-67372.
• Exchange Server (code injection, authorisation bypass and input validation): CVE-2026-118149, CVE-2026-118150, CVE-2026-118154, CVE-2026-118207; for CVE-2026-118207, the advisory states that the attacker must be authenticated.
• Visual Studio: CVE-2026-114151, CVE-2026-114152, CVE-2026-114158, CVE-2026-114159, CVE-2026-118745; Visual Studio Code: CVE-2026-114171, CVE-2026-119975, CVE-2026-119983, CVE-2026-121663, CVE-2026-121665.
• Windows: DNS Server (CVE-2026-112727), Print Spooler (CVE-2026-112762, CVE-2026-119950), kernel (CVE-2026-112805), DHCP Client (CVE-2026-113863), Codecs Library (CVE-2026-114164), Active Directory Domain Services (CVE-2026-118146), Remote Desktop Client (CVE-2026-119824, CVE-2026-119839, CVE-2026-119934), Input System (CVE-2026-119862, CVE-2026-119916), SMB (CVE-2026-122176) and PowerShell (CVE-2026-124226).
• Other: Microsoft Defender (CVE-2026-122194) and a path traversal flaw in a Microsoft product not specified in the available excerpt (CVE-2026-124228).

What to do

The available data does not list affected or fixed versions; the reference is the MSRC Security Update Guide, which identifies the specific patch for each product.

• Urgently install the Outlook updates that fix CVE-2026-124194, by 24 November at the latest.
• Prioritise Windows servers running DNS, DHCP, LDAP or Kerberos, especially domain controllers, and those using iSCSI.
• Update SharePoint, SQL Server and Exchange Server as soon as possible and check whether they are exposed to the internet; if so, restrict access until the patch is applied.
• Roll out the Office updates (Word, Excel, Outlook, Access, Visio and PowerPoint) to all machines and remind users to be wary of unexpected emails and documents.
• Update Visual Studio, Visual Studio Code and ASP.NET Core-based applications on developer machines.
• For cloud services (Azure DevOps, Azure OpenAI, Azure Managed Grafana and Microsoft Graph), check each CVE advisory to see whether any customer action is required.

Sources

• Microsoft MSRC: CVE-2026-124194 (Outlook)
• Microsoft MSRC: CVE-2026-109467 (Azure DevOps)
• Microsoft MSRC: CVE-2026-120002 (SharePoint)
• Microsoft MSRC: CVE-2026-116945 (SQL Server)
• Microsoft MSRC: CVE-2026-88218 (Windows DNS)
• Microsoft MSRC: CVE-2026-85844 (Windows Kerberos)
• MSRC: CVE-2026-119958 (Windows LDAP)

Affected technologies

Vulnerabilities (377)