Among the 1,093 bugs disclosed on Tuesday, Microsoft said one is being exploited in the wild: CVE-2026-124194. The company said it has a severity score of 6.5 and impacts Microsoft Outlook. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog and gave federal agencies until the end of the month to patch it.
Microsoft said the bug was discovered by Benoît Sevens using Anthropic’s Claude, writing that an attacker “could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.” “Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the company said. Satnam Narang, senior staff research engineer at Tenable, said an attack using the vulnerability may allow someone to sign in as the exploited user. Several experts said CVE-2026-124194 was the only exploited bug outlined in Microsoft’s Patch Tuesday release but there were 63 vulnerabilities rated critical.
