Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.

These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs.

With the latest round of fixes, Microsoft has addressed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable.

Of these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited by Microsoft.

"Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network," Microsoft said in an advisory.

An unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Microsoft Outlook.

This, in turn, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information, such as an NTLMv2 hash, that could be used to impersonate the user.

Microsoft emphasized that successful exploitation requires network connectivity and user interaction. The tech giant credited a researcher named Nono and Anthropic's Benoît Sevens (using Claude) with discovering and reporting the flaw.

"Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity," Jack Bicer, director of vulnerability research at Action1, said.

Source link