Microsoft Was Warned About an Outlook Zero-Day: Two Days Later, a Global Outage Hit

Microsoft's global cloud outage, which began on 12 November and continued into the following day, has drawn attention to a cybersecurity warning issued just two days earlier.

On 10 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added an actively exploited zero-day vulnerability in Microsoft Outlook to its Known Exploited Vulnerabilities (KEV) catalogue.

No evidence has established a connection between the security flaw and the widespread service disruption.

The timing was highlighted by an X user posting under the handle @Nerdy_Addict. In a post published on 13 November, the user pointed out that CISA had flagged the Outlook vulnerability shortly before Microsoft's cloud services experienced widespread disruption.

The user noted the timing but stressed that no link between the incidents had been established. CISA's listing confirms active exploitation, not that Microsoft received or ignored a private warning.

Microsoft Outlook Zero-Day Was Already Being Exploited

The vulnerability, tracked as CVE-2026-124194, is a spoofing flaw affecting Microsoft Outlook. Microsoft assigned it a Common Vulnerability Scoring System (CVSS) rating of 6.5, placing it in the moderate severity category, while confirming that exploitation had been detected.

The flaw could allow an unauthenticated attacker to expose a user's authentication information without first obtaining their account password.

An attacker would need to send a specially crafted message file and persuade the intended victim to open it in an affected version of Outlook.

Once opened, the file could cause Outlook to connect to an attacker-controlled network location without displaying its usual warning about external content.

That connection could expose the victim's NTLMv2 hash, which an attacker could potentially use in authentication attempts to impersonate the affected user.

This is not a zero-click attack or a vulnerability that automatically gives an attacker control of a computer. Microsoft says successful exploitation requires user interaction and network connectivity. The Outlook Preview Pane is also not an attack vector for this particular flaw.

The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft has released security fixes, with CISA giving US federal agencies until 24 November 2026 to apply them.

Microsoft Cloud Outage Had a Separate Explanation

The outage began on 12 November, disrupting Microsoft 365 services, including Outlook and Teams, alongside other cloud-based tools. Users in multiple regions experienced problems accessing services, with disruption continuing into 13 November.

Microsoft's incident updates described servers unexpectedly becoming unavailable and failing automated health checks, placing additional pressure on the remaining infrastructure.

The company also identified an overwhelmed core process on affected servers and encountered difficulties restoring capacity as recovery efforts continued.

Australian Home Affairs Minister Tony Burke said Microsoft did not believe the incident was a cyberattack. Microsoft also indicated that it had no evidence of malicious or cyber activity being responsible for the disruption.

These statements provide an important distinction between the two developments. Microsoft's reported infrastructure problems offer a separate explanation for the outage, while the company has not identified the Outlook vulnerability as a contributing factor.

Microsoft's assessment found no direct impact on service availability from CVE-2026-124194. The vulnerability poses authentication risks, but there is no evidence linking it to the separate cloud outage.

The X post has drawn attention to the proximity of the two events, but their timing alone does not establish a common cause. Whether further technical disclosures will reveal additional details about Microsoft's outage remains to be seen.