Microsoft confirms Outlook outage as CISA adds exploited vulnerability to catalog

Microsoft confirmed Thursday that users were experiencing difficulties accessing Exchange Online mailboxes through multiple connection methods, initially reporting disruptions across the Americas. The company later acknowledged that the problems could affect Microsoft 365 service connectivity in any region.

According to outage-monitoring service DownDetector, more than 130,000 users reported problems accessing Outlook at approximately 1:15 p.m. Eastern. Less widespread problems were also reported with Microsoft Copilot, Teams, OneDrive and Microsoft Store.

Microsoft said it has been working to restore service by redirecting traffic away from affected infrastructure, pausing deployments and restarting servers. By approximately 4 p.m. Eastern, the company reported progress restoring affected servers and said additional recovery measures were being implemented.

The reported vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability identified as CVE-2026-124194. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, setting a November 24 remediation deadline.

According to Microsoft’s security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook. The application may then connect to an attacker-controlled network location without showing its usual warning about external content. That connection can disclose the victim’s NTLMv2 hash, authentication data that an attacker could use to impersonate the user.

Microsoft classifies the issue as spoofing rather than remote code execution. Its assessment identifies a high impact on confidentiality, but no direct impact on data integrity or service availability. The weakness falls under CWE-356, which covers software that fails to obtain proper user approval before a potentially unsafe action.

Microsoft released security updates for the flaw. Fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps customers must consult the applicable Office security release information rather than assume the LTSC build numbers apply to their update channel.

Connection to the outage

The outage coincides with reports of the Microsoft Outlook security vulnerability, but there is no confirmed connection between the reported vulnerability and the widespread service outage. Neither Microsoft nor CISA has identified a cyberattack as the cause of Thursday’s disruption.

Microsoft has not provided a confirmed timeline for the complete restoration of affected Outlook services.

---

Sources

• moosejawtoday.com: Microsoft confirms Outlook outage across the Americas, potentially the globe, amid U.S. Cyber Security Agency's discovery of Outlook vulnerability - MooseJawToday.com
• play1037.ca: Microsoft confirms Outlook outage across the Americas and potentially the globe amid U.S. Cyber Security Agency’s discovery of Outlook vulnerability | play 103.7 | Harvard Media
• cyberpress.org: CISA Confirms Active Exploitation of Microsoft Outlook Zero-Day Vulnerability
• cybersecuritynews.com: CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.