Microsoft Suffers Major Outage as U.S. CISA Confirms Actively Exploited Outlook Vulnerability
Nearly 130,000 people could not open Outlook on November 12 while a confirmed zero-day flaw continues to leak login data from the same program.
On Thursday, November 12, 2026, Microsoft’s cloud tools stopped working. Outlook, the email system used by businesses across the country, went down along with Teams, Copilot, SharePoint, and parts of the security tools that go with them. Downdetector logged a peak of 128,874 reports of Outlook trouble around 1:09 p.m. Eastern. Microsoft said the problem started with users in the Americas who could not reach their Exchange Online mailboxes and later warned it could hit people in any region.
This was not a sudden rush of users. Microsoft said a large number of its own servers became unexpectedly unavailable and began failing automatic health checks. The machines still running had to carry the extra load. The company paused new deployments and started restarting the bad servers. By late afternoon some service was returning, but Microsoft had not named a root cause. Reports noted no evidence of a cyberattack.
Microsoft 365 is the office suite used by hundreds of millions of people. When it stalls, companies cannot send ordinary emails, share files, or run meetings. Workers said they could not email purchase orders to suppliers who also run on Outlook. Orders sat. Work waited.
The same week brought a separate Outlook problem. The U.S. Cybersecurity and Infrastructure Security Agency confirmed that attackers are actively exploiting a zero-day flaw in the desktop version of Outlook, tracked as CVE-2026-124194. Microsoft rates it moderate, with a score of 6.5. An attacker can send a specially crafted message file. If a user opens it, Outlook connects to a server the attacker controls without showing its usual warning about outside content. That connection can hand over the user’s NTLMv2 hash—a scrambled form of the Windows login that an attacker can use to pretend to be that person on the network. CISA added the flaw to its list of known exploited vulnerabilities on November 10 and told federal agencies to fix it by November 24. Microsoft patched it in its November updates for Microsoft 365 Apps and certain Office long-term versions.
Big tech companies have spent years telling businesses to move everything into their clouds and to trust the software on their desktops. Thursday’s outage showed what happens when one company’s servers quit. The zero-day showed that even after a patch is available, an actively used hole in the everyday email client can still leak credentials. Most large employers are locked into Microsoft’s stack. When the stack fails or when attackers exploit a known flaw in it, there is little quick alternative.
People who have watched big tech for years have long pointed out the risk of putting so much ordinary work under one roof. The companies collect the data, set the rules, and run the servers. Customers get convenience until the servers quit or a flaw in the client is used against them.
Sources / More reading
- TechCrunch: https://techcrunch.com/2026/11/12/microsofts-outlook-email-hit-by-new-outage/
- WIRED: https://www.wired.com/story/major-microsoft-outlook-outage-hits-365-customers-north-america/
- The Guardian: https://www.theguardian.com/technology/2026/nov/13/microsoft-outage-outlook-teams-word-excel-reports
- USA Today: https://www.usatoday.com/story/tech/2026/11/12/microsoft-down-outlook-365-outage-reports/92744582007/
- BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/
- Microsoft Security Advisory (CVE-2026-124194): https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2026-124194
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124194
- SecurityWeek: https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/
- Office Watch: https://office-watch.com/2026/classic-outlook-vulnerability-update-office/
- Breach Briefing: https://breachbriefing.com/en/cve/CVE-2026-124194