Microsoft has released its latest monthly security update, marking the second consecutive month in which the company has disclosed more than 1,000 vulnerabilities. The November release includes 1,093 distinct security flaws, contributing to a record-breaking year for the vendor, which has now disclosed over 5,160 vulnerabilities throughout 2026. This volume of disclosures significantly exceeds the figures reported in previous years.
Among the massive cache of updates, Microsoft confirmed that one specific vulnerability, CVE-2026-124194, is currently being exploited in the wild. This flaw, which carries a severity score of 6.5, affects Microsoft Outlook. According to the company, the vulnerability allows an attacker to send a specially crafted message file that, when opened by a user, forces Outlook to connect to an attacker-controlled network location. Crucially, this process occurs without triggering the standard external-content warning, potentially exposing authentication information that could allow an unauthorized party to impersonate the targeted user.
The discovery of CVE-2026-124194 is attributed to researcher Benoît Sevens, who utilized Anthropic’s Claude to identify the issue. Following the disclosure, the Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities catalog. Federal civilian agencies have been mandated to apply the necessary patches by the end of the month. While this was the only Microsoft-specific bug identified as currently under active exploitation, the company noted that the broader release includes 63 vulnerabilities classified as critical.
The November security landscape extends well beyond Microsoft, as several other major technology firms also issued patches for dozens of vulnerabilities. CISA has issued separate directives for federal agencies regarding products from Google, Cisco, Adobe, Barracuda, and Ivanti. Specifically, agencies have been ordered to patch two vulnerabilities affecting Barracuda’s email security products, identified as CVE-2026-116606 and CVE-2026-111560. Federal entities are required to complete these updates by this coming Friday and must also conduct investigations into their systems to check for potential compromises related to these specific Barracuda flaws.
In a separate development, N-able, the provider of the N-Central remote management tool, is addressing a series of more than 30 serious vulnerabilities discovered by an external researcher. The tool, which is widely used by IT teams for network monitoring and management, has faced significant operational disruption as a result. N-able took the proactive step of taking all hosted N-Central environments offline and instructed customers to power down their own servers to mitigate risk.
Regarding the N-Central situation, N-able confirmed that it has observed scanning activity linked to published proof-of-concept code associated with the vulnerabilities. However, the company stated that it currently has no evidence that any customer environment has been successfully compromised. During this period of remediation, customers remain unable to access their hosted N-Central classic environments, and associated services are expected to remain unavailable until the situation is resolved.
