It’s another doozy of a Patch Tuesday, with Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch. Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register : “Maybe we should just go home.” “Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,” Knott told us. Starting with the zero-day: It’s an Outlook spoofing vulnerability, tracked as CVE-2026-124194 , and it only garnered a 6. 5 out of 10 CVSS rating. But as Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warns, don’t let the score or the name lull you into thinking it’s OK to put off patching this one. “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review . “An attacker sends a specially crafted message file and convinces a user to open it,” he wrote. “Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user.” Microsoft marked CVE-2026-124194 as exploited, but per usual didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation. These details will likely start trickling out soon. Plus, now that there’s a public fix, other miscreants are undoubtedly already scanning for vulnerable versions and reverse engineering the patch for their own attack purposes. So prioritize this fix, and keep an eye on your inbox for any suspicious files. Back-to-back months of 1K+ CVEs
Despite the second month of more than 1,000 CVEs (October had 1,474 ), CVE-2026-124194 is the only one under active exploitation, and none of the 1,094 are listed as publicly known. Childs says this shouldn’t give organizations “false comfort.” “Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume,” he told The Register …