Microsoft’s global cloud outage, which began on 12 November and continued into the following day, drew attention because the US Cybersecurity and Infrastructure Security Agency (CISA) had added an actively exploited Outlook zero-day to its Known Exploited Vulnerabilities catalogue two days earlier. There is no evidence that the vulnerability was connected to the widespread service disruption.
Details of the Outlook zero-day
CISA added the vulnerability to its KEV list on 10 November, confirming active exploitation. The flaw is tracked as CVE-2026-124194 and is a spoofing vulnerability in Microsoft Outlook that Microsoft rated with a CVSS score of 6.5 (moderate). Microsoft said exploitation had been detected.
According to the advisory, an unauthenticated attacker could expose a user’s authentication information without first obtaining the account password. Exploitation requires the attacker to send a specially crafted message file and convince the victim to open it in an affected version of Outlook. Once opened, the file could cause Outlook to connect to an attacker-controlled network location without displaying its usual warning about external content, potentially exposing the victim’s NTLMv2 hash for use in authentication attempts.
Microsoft and CISA emphasised that this is not a zero-click attack and does not automatically give an attacker control of a computer; successful exploitation requires user interaction and network connectivity. The Outlook Preview Pane is not an attack vector for this flaw. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft has released security fixes, and CISA set a deadline of 24 November 2026 for US federal agencies to apply them.
An X user posting as @Nerdy_Addict highlighted the proximity of CISA’s listing to the outage in a post on 13 November, noting the timing while stressing that no link between the two incidents had been established. CISA’s listing indicates active exploitation but does not mean Microsoft received or ignored a private warning.
Microsoft says outage had a separate explanation
The outage began on 12 November and affected Microsoft 365 services including Outlook and Teams, with users across multiple regions reporting access problems into 13 November. Microsoft’s incident updates described servers unexpectedly becoming unavailable and failing automated health checks, an overwhelmed core process on affected servers, and difficulties restoring capacity during recovery efforts.
Australian Home Affairs Minister Tony Burke said Microsoft did not believe the incident was a cyberattack, and Microsoft indicated it had no evidence of malicious or cyber activity causing the disruption. Microsoft’s assessment found no direct impact on service availability from CVE-2026-124194. The proximity in timing has drawn attention, but the company and CISA have not identified the Outlook vulnerability as a contributing factor. Whether further technical disclosures will reveal additional details about the outage remains to be seen.
