Exploited Outlook zero-day was found by a researcher using Claude

Microsoft released its monthly security updates for Windows, Office and other products on November 10, 2026. One of the flaws it fixed is in Outlook, and Microsoft says attackers are already exploiting it. It is tracked as CVE-2026-124194. The advisory credits a researcher who goes by "nono" along with Benoît Sevens, whose acknowledgment reads "using Claude with Anthropic".

Opening one crafted file is enough

Microsoft classifies the bug as a spoofing vulnerability, rates it Moderate and gives it a CVSS score of 6.5. An attacker sends a specially crafted message file and gets the victim to open it in Outlook. Outlook then connects to a server the attacker controls without showing the usual warning about external content. According to Microsoft, the flaw "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user." The Preview Pane is not an attack vector, so the file has to be opened. Microsoft has not shared any details about the attacks.

The advisory lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected. Office 2016 and Office 2019 are not on the list, but neither has received security updates since October 2025.

Close to 1,100 fixes in one month

Tenable counts 1,093 Microsoft CVEs in this release, 63 of them rated Critical, while SecurityWeek arrives at 1,094. Microsoft's own Security Update Guide lists even more entries because it also includes third-party flaws such as those in Chromium. In October, Microsoft fixed a record 1,413 vulnerabilities, according to SecurityWeek. Brian Krebs points out that a year ago Microsoft was averaging around 100 patches per month. He also says the company credits advances in AI for helping it find and fix so many bugs.

AI companies say their models are now good at finding security flaws. OpenAI rates its GPT-6 Cyber model as Critical under its own risk framework. In the Outlook case, a researcher used AI to report a flaw that was already being exploited. The advisory does not say whether he found it through an attack in progress.

How to install the updates now

On Windows 11, open Settings and go to Windows Update. The November update is KB5132061, and our Patch Tuesday story covers what else it changes. Office usually updates itself automatically. If you do not want to wait, open Outlook, go to File, Office Account, Update Options and click Update Now. For Office LTSC 2024, build 16.0.17932.21140 contains the fix. For Office LTSC 2021, it is build 16.0.14334.21048.

Until the update is installed, avoid opening message files or Office documents from unexpected emails, even if the sender looks familiar. Krebs also recommends backing up important data before applying operating system updates.