The Only Exploited Flaw This Month Was Rated Moderate

Microsoft's November 2026 Patch Tuesday fixed more than 1,000 vulnerabilities. Sixty-three of them were rated Critical. Over a thousand were rated Important. Exactly one was rated Moderate.

That one Moderate flaw was the only vulnerability in the entire release that attackers were already using.

If your patching queue is sorted by CVSS score, the single bug under active attack sat at the very bottom of your list this week. That is the whole argument of this article, and the rest is detail.

What CVE-2026-124194 actually does

The flaw is tracked as CVE-2026-124194, a Microsoft Outlook spoofing vulnerability with a CVSS score of 6.5.

The attack is simple. An attacker sends a crafted message file and persuades the target to open it in Outlook. Outlook then connects to a network location the attacker controls, and it does so without the usual warning about external content. That connection hands over the user's NTLMv2 authentication hash.

"Spoofing" and "6.5" make this sound like a nuisance. It is not. An NTLMv2 hash can be cracked offline or relayed to other services to authenticate as the victim. For an attacker, that is a foothold: one opened file, one set of credentials, and a path to lateral movement.

Three facts should have pushed this to the top of every queue:

Microsoft confirmed exploitation before the patch existed. It was a true zero-day.
CISA added it to the Known Exploited Vulnerabilities catalog on November 10, the same day the patch shipped, with a federal remediation deadline of November 24.
The fix ships through Office updates, not the Windows cumulative update. Organizations that patched Windows and considered the month done are still exposed.

None of those three facts is visible in the number 6.5.

The outage that was not caused by it

Two days after Patch Tuesday, Microsoft 365 suffered a major global outage. Outlook, Teams, Copilot and other services were disrupted across dozens of countries, and the disruption ran into a second day.

Many people connected the two stories, and I have seen posts claiming the Outlook zero-day took down Microsoft 365. That claim is not supported. Microsoft has said the outage was a technical issue and not a cyberattack: a bug introduced during an earlier network capacity upgrade, which surfaced after a recent network change. Affected servers failed automated health checks and dropped out of service. Microsoft has promised a full post-incident report, and none of its service advisories link the vulnerability to the outage.

I am including this because it supports the same point from a different direction. When something big breaks, we reach for the nearest scary headline. When we prioritize patches, we reach for the nearest big number. Both are shortcuts that replace analysis with pattern matching.

What CVSS measures, and what it does not

CVSS is not broken. It is being asked a question it was never designed to answer.

A CVSS base score describes the intrinsic severity of a vulnerability: how it is reached, how complex the attack is, whether a user has to do something, and what happens to confidentiality, integrity and availability if it succeeds. It is a statement about the flaw in isolation.

It says nothing about:

Whether anyone is exploiting it right now
How likely exploitation is in the next 30 days
Whether the affected asset is exposed, or critical to your business
What an attacker can chain it with once they are in

This Outlook flaw scores lower partly because it needs a user to open a file. In a lab, that is a real barrier. In a company with thousands of mailboxes, someone opens the file. User interaction is a speed bump for attackers, and a scoring system treats it as a wall.

This is also not a one-off. Industry analysis of this release noted it was the third consecutive month in which the vulnerability attackers were actually using was rated below Critical.

A better sort order

Severity still belongs in the decision. It just should not be the first column you sort by. A workable order looks like this:

Is it being exploited? Check CISA's KEV catalog and the vendor's exploitation status. A known-exploited flaw goes first regardless of score.
How likely is exploitation? EPSS gives a probability that a vulnerability will be exploited in the near term. It is a prediction, which is what prioritization needs.
Where does it live in your environment? An internet-facing system, an identity system, or the mail client on every desk is a different risk from an isolated test server.
Then severity. Use CVSS to rank what is left.

If you want a formal framework, SSVC (Stakeholder-Specific Vulnerability Categorization) builds this logic into a decision tree with outcomes like "act now" or "track," instead of a number that invites sorting.

From an audit perspective, this matters too. ISO/IEC 27001:2022 control A.8.8 asks organizations to evaluate their exposure to technical vulnerabilities and take appropriate measures. A policy that reads "Critical within 7 days, High within 30, Medium within 90" is easy to write and easy to audit. It also would have given this actively exploited zero-day a 90-day window. Compliance with your own SLA is not the same as managing the risk.

What to do this week

Update Office now. Confirm the Outlook fix is deployed through your Office update channel, and do not assume Windows Update covered it.
Reduce NTLM exposure. Block outbound SMB at the perimeter where you can, and review where NTLM is still permitted internally.
Add an exploited-first rule to your patch policy. Anything on KEV or marked "Exploitation Detected" by the vendor jumps the queue, whatever its score.
Review your SLAs. If they are keyed only to CVSS bands, add exploitation status and asset criticality as inputs.
Read the post-incident report on the outage when it lands. Microsoft has committed to publishing one. Draw your lessons from that, not from the timing.

More than a thousand patches, sixty-three Critical, and the one under attack was the only Moderate. A score tells you how bad a vulnerability could be. It does not tell you which one to fix first.