CERT-In Reports Outlook Exploitation in Microsoft Advisory

A Microsoft Outlook vulnerability was being exploited in the wild at the time of CERT-In’s November 12, 2026 advisory on Microsoft security flaws, according to the agency. Microsoft’s security entry also identifies the Outlook flaw, CVE-2026-124194, as exploited.

Microsoft classifies the vulnerability as spoofing and says exploitation depends on a recipient opening a specially prepared message file in an affected version of Outlook. The attacker sending that file does not need to be authenticated. According to Microsoft, opening it can cause Outlook to access a network location controlled by the attacker, potentially exposing the user’s NTLMv2 hash. Microsoft states that the Preview Pane is not a route for this attack.

The Outlook entry carries a Moderate rating from Microsoft. CERT-In assigns High severity to advisory CIAD-2026-0059 as a whole, which covers vulnerabilities across multiple Microsoft products. The two ratings therefore apply to different scopes: Microsoft’s assessment concerns the individual Outlook vulnerability, while the agency’s assessment covers the broader set.

Among the affected products listed by CERT-In are Microsoft 365 Apps, Office, Windows and Windows Server. The advisory also covers vulnerabilities affecting SQL Server, SharePoint Server, Exchange Server and Internet Information Services. Its scope extends to Edge, PowerShell,.NET, Entra, Azure components, Microsoft Developer Tools and other supported Microsoft components.

CERT-In’s recommendation is to install the Microsoft security updates relevant to the vulnerabilities covered by the advisory. For patches and associated guidance, the agency directs readers to Microsoft’s security update release notes for November 2026.

* This article is based on publicly available information at the time of writing.