"This month’s Patch Tuesday release addressed 1093 CVEs, a continuation of the trend we’ve observed in 2026. This brings us to over 5100 CVEs patched for Patch Tuesday this year (5162) with one more month left to go.
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It’s rated moderate and has a CVSS score of 6.5. To exploit it, an attacker sends a target a malicious Office file and convinces them to open it. If the attack succeeds, the attacker captures the victim's NT LAN Manager v2 (NTLMv2) hash, a value derived from their Windows password. The attacker may be able to relay it to other systems to sign in as the user, or crack it to recover the password. Microsoft’s advisory says exploitation has been detected, which makes it a zero-day. Microsoft also credits a researcher that discovered it using Claude. The advisory doesn’t say whether the discovery came before or after attackers began exploiting the flaw. For most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle."– Satnam Narang, Senior Staff Research Engineer at Tenable
