Microsoft patches more than 1,000 flaws again, including an exploited Outlook bug found with Claude

For the second month in a row, Microsoft's Patch Tuesday release fixes more than 1,000 vulnerabilities. Outlets report different totals: The Record counts 1,093 bugs, CyberScoop says 1,094 CVEs are formally listed, BleepingComputer gives 1,235 and The Hacker News 1,259. CyberScoop says Windows accounts for 726 of the fixes and Office for 174. Only one flaw is known to be exploited: CVE-2026-124194, an Outlook spoofing bug with a severity score of 6.5. Microsoft says a specially crafted message file can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning, which may leak authentication information that can be used to impersonate the user. Microsoft credits Benoît Sevens, who found the bug using Anthropic's Claude. CISA added the flaw to its Known Exploited Vulnerabilities catalog. Security Affairs also counts 30 wormable flaws in the release. Dustin Childs of the Zero Day Initiative says fewer zero-days are being exploited, but that this does not mean less exploitation overall, because AI is better at reverse-engineering patches than at finding bugs in closed-source software. Windows 10 users enrolled in extended security updates receive the fixes in KB5131096.