CERT-In Issues High Severity Advisory for Microsoft Products: Critical Outlook Zero-Day Exploited in the Wild Under CIAD-2026-0059

The Indian Computer Emergency Response Team (CERT-In), operating under the Ministry of Electronics and Information Technology (MeitY), has issued a high-severity security advisory categorized as CIAD-2026-0059. The warning alerts enterprise administrators and individual users across India to multiple critical vulnerabilities affecting Microsoft software, highlighted by an actively exploited zero-day flaw in Microsoft Outlook that exposes user authentication data.

Key Highlights of CERT-In Advisory CIAD-2026-0059:

• Active In-The-Wild Exploitation: CERT-In confirms that Microsoft Outlook vulnerability CVE-2026-124194 is being actively exploited by attackers to force remote authentication leaks without displaying standard security warnings.
• Critical Enterprise Scope: The advisory encompasses core corporate platforms including Microsoft Exchange Server, SharePoint Server, SQL Server, Windows Server, Azure components, and Microsoft Entra.
• Multi-Vector Threat Profile: Identified weaknesses enable remote code execution (RCE), elevation of privilege (EoP), sensitive information disclosure, security feature bypass, and denial-of-service (DoS) disruptions.
• Immediate Remediation Mandate: The government cybersecurity agency urges system administrators and security operations centers to deploy Microsoft’s November 2026 security updates without delay.

CERT-In Advisory CIAD-2026-0059: Vulnerability Breakdown and Affected Microsoft Software

Remediation Steps, Vendor Patches, and Enterprise Mitigation

To neutralize these threats, CERT-In directs all affected entities to immediately apply the patches released under the official Microsoft November 2026 Security Release. Individual desktop users should verify that their systems have received the latest monthly rollouts through Windows Update, matching the servicing architecture established in the recent Windows 11 November 2026 update. Furthermore, standalone Microsoft 365 Apps installations must be updated directly via the Click-to-Run channel.

For enterprise environments, priority patching must focus on externally exposed Microsoft Exchange Server and SharePoint instances. The urgency follows recent cloud disruptions across enterprise mailboxes detailed in our Microsoft 365 global infrastructure outage report. Security operations teams should also implement perimeter firewall rules to block outbound SMB traffic (TCP port 445) from corporate endpoints. This prevents credential reflection and NTLM relay harvesting if a malicious message file bypasses initial spam filters.

PFD Context

CERT-In’s urgent notification underscores how client-side email vulnerabilities continue to serve as the primary entry point for advanced persistent threat actors targeting Indian enterprise networks. Because CVE-2026-124194 bypasses standard external connection alerts in Outlook, an attacker requires only minimal user interaction to harvest password hashes. Organizations must treat this advisory as a zero-tolerance patching emergency to prevent initial foothold compromise and lateral network movement.