Microsoft security patches: 1,093 fixes, Outlook zero-day

Microsoft issued a very large patch release this week, shipping fixes for 1,093 vulnerabilities across Windows and supported products, and confirming one Outlook vulnerability is being actively exploited, according to Krebs on Security. This wave includes 63 critical flaws and a large number of issues that let attackers elevate privileges or run code with little user interaction.

Microsoft security patches: what was fixed

Krebs on Security reports the November release addresses 1,093 separate defects, with 63 categorized as critical and 535 allowing privilege escalation. Microsoft says the company has shipped more than 5,100 security patches so far this year, and it attributes recent increases in bug discovery and fixes in part to advances in artificial intelligence. Among the critical items, Krebs notes one flaw is already under active exploitation: CVE-2026-124194, a spoofing bug in Outlook that affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.

The scale here is notable: last month Microsoft pushed more than 1,400 fixes, and this month again exceeds a thousand. That volume makes prioritization essential for small IT teams and administrators with limited maintenance windows.

Other major vendor updates this week

Multiple vendors released security updates around the same time. Krebs on Security and vendor advisories report:

• Apple released out-of-cycle updates for iOS, iPadOS, macOS, watchOS and visionOS to fix at least nine vulnerabilities, including two iMessage issues that could let a remote attacker join a group chat or allow someone added to a group to see messages sent before they joined. The fix was backported to iOS 18, according to a SANS instructor quoted in Krebs.
• Google pushed Chrome 157.0.8103.50, which resolves nine security issues including CVE-2026-125350, the sixth Chrome zero-day this year; Chromium-based browsers such as Edge are also affected, Krebs reports.
• Mozilla released Firefox 160 to address nearly 100 CVEs, about half rated high severity, according to Krebs.
• Adobe patched at least 110 vulnerabilities across multiple products, with nearly half classified as high severity; Adobe reports no evidence of exploitation for these fixes.
• SecurityWeek reports Fortinet published 89 advisories covering nearly 100 vulnerabilities. About 17 of the Fortinet flaws are critical, affecting FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE and FortiClient. Fortinet says it has integrated frontier AI models into its security testing to find defects more quickly. One researcher named a FortiClient issue Fortinet2Shell; it relies on a CORS misconfiguration and could allow arbitrary code execution when FortiPAM is enabled and a user visits a malicious web page. Fortinet does not report exploitation in the wild.

Why this matters for small organizations and public teams

Krebs cites industry commentators noting the number of CVEs assigned across vendors this year is very large, yet only a small subset appear on CISA's Known Exploited Vulnerabilities list. Chris Goettl, quoted in Krebs, emphasizes that many exploited issues sit in operating systems, endpoint software, browsers and server platforms, which a continuous patch strategy can close quickly. He also notes that a substantial share of exploited flaws live in edge devices and remote access tools, which require exposure management as well as patching. For smaller teams, that makes prioritizing active exploits and internet-facing systems more effective than trying to tackle every bulletin at once.

Practical steps you can take now

• Prioritize the Outlook patch that is reported as actively exploited and any other updates for software you run that are listed as under active attack, according to vendor advisories.
• Update browsers (Chrome, Firefox, Edge) and email clients as soon as you can, since many recent fixes affect code execution and remote access.
• Apply Fortinet updates if you use their products, and review FortiPAM and web-facing services for risky CORS or local service exposures described by researchers.
• Back up important data before applying major OS updates, as recommended in Krebs on Security, so you can recover if an update causes issues.
• Inventory internet-facing systems and remote access tools, then confirm which ones are exposed and prioritize patching or compensating controls for those assets, following the exposure management advice noted by industry sources.

If you want a quick starting point, run an external scan to see how exposed your public systems are: /security.html

Final note

This was a high-volume week for security fixes across multiple vendors. Focus first on flaws known to be exploited, browsers and email clients, and any internet-facing or remote access appliances you run. Keep backups current and allocate time for testing and staged rollouts when possible.