Laws and sections by number or title, due dates, pages, and updates.
CERT-In reports multiple vulnerabilities in Microsoft products that allow remote code execution, privilege escalation, and information disclosure. Attackers exploit these flaws to bypass security features or cause denial-of-service conditions. One specific vulnerability, CVE-2026-124194 in Microsoft Outlook, currently faces active exploitation in the wild. This flaw allows an unauthenticated attacker to steal authentication information through a crafted message file. Affected users include individuals and IT administrators responsible for Microsoft software maintenance. Users must apply the security updates provided by Microsoft immediately to mitigate these risks. Refer to the official Microsoft security update guide for the complete list of affected products and specific patch instructions.
What you must do
Key dates
Who is affected
If you do not comply
Ask about this advisory
CERT-In Advisory CIAD-2026-0059
Multiple Vulnerabilities in Microsoft Products
Original Issue Date: November 13, 2026
Severity Rating: High
Microsoft Windows
Microsoft Office
Microsoft 365 Apps
Microsoft Exchange Server
Microsoft SharePoint Server
Microsoft SQL Server
Microsoft Edge
Microsoft .NET
Microsoft PowerShell
Windows Server
Microsoft Azure components
Microsoft Entra
Windows Internet Information Services (IIS)
Microsoft Developer Tools and other supported Microsoft components
Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, execute arbitrary code remotely, obtain sensitive information, bypass security features, conduct spoofing attacks or cause denial-of-service (DoS) conditions.
Target Audience:
Individuals and IT administrators, security teams responsible for maintaining and updating Microsoft products.
Risk Assessment:
Risk of remote code execution, privilege escalation, unauthorized access and sensitive information disclosure.
Impact Assessment:
Potential compromise of systems, credential theft, unauthorized access to sensitive data, system disruption or denial of service.
Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, execute arbitrary code remotely, obtain sensitive information, bypass security features, conduct spoofing attacks or cause denial-of-service (DoS) conditions.
CVE-2026-124194
:
This vulnerability exists in Microsoft Outlook due to improper handling of potentially unsafe user actions. An unauthenticated attacker could exploit this vulnerability over a network by sending a specially crafted message file and convincing a user to open it, potentially causing Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, thereby exposing authentication information.
Note: This vulnerability is being exploited in the wild. Users are advised to apply patches immediately.
For complete list of affected products, CVEs, workarounds and solutions, refer to the Microsoft security updates.
https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov
Apply appropriate security updates as mentioned in
https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov
Microsoft
https://msrc.microsoft.com/update-guide/
https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov
