Security administrators are getting used to the new normal on the second Tuesday of every month when Microsoft drops its latest batch of security fixes, but the total number of patches released this Tuesday actually declined compared to October.
There are still a lot of them: Microsoft released patches for 1,094 separate CVEs on Tuesday, plugging holes primarily in Windows but also addressing security issues in Azure, SQL Server, and Developer Tools. Only one of them, however, is being actively exploited.
That flaw — assigned number CVE-2026-124194 — is a spoofing vulnerability in Microsoft Outlook that was deemed of "moderate" severity on the CVE scale. "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," which would have the effect of routing your Outlook client to the nearest hacker with bad intentions, Microsoft said in the advisory.
"Email is the easiest door into any company, and this flaw turns one opened file into stolen identity," Action1 's Jack Bicer, director of vulnerability management, said in a statement. "A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach," he wrote, opining that the moderate label "undersells this one."
Critical mass
Microsoft attached the "critical" label to 63 vulnerabilities, which was also down from last month's total. Admins were forced to deal with 1,408 patches in October and 997 in September, which means Microsoft has released nearly three times as many patches in the last three months as it did in all of 2025.
The critical vulnerabilities that Action1 singled out for immediate attention were remote-code execution flaws in LDAP and Exchange Server and an escalation of privilege vulnerability in the Azure OpenAI service. All of those flaws can be exploited without having to trick the end user into opening a file or clicking a link, which makes them especially concerning.
While security teams might be relieved to only see one flaw that is being actively exploited, that doesn't mean they should drag their heels patching the result of the batch, according to Dustin Childs of Trend Micro's Zero Day Initiative.
"While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild," he wrote in a blog post. "This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software."
The Stack keeps its security reporting free for public interest purposes. You can support our independent journalism and grab a 50% discount to tickets for our events by subscribing for $300/year.
