Microsoft has patched a flaw in Outlook for Windows that attackers were already using before a fix existed. The bug, CVE-2026-124194, lets a booby-trapped message file make Outlook quietly connect to a server the attacker controls and hand over a scrambled form of the user’s Windows sign-in, which can then be used to log in as that person.
The fix arrived in Microsoft’s November Patch Tuesday release on Tuesday 10 November US time (early Wednesday in eastern Australia), alongside fixes for roughly 1,100 other Microsoft vulnerabilities. Here’s who is affected, the Office build numbers that mean you’re safe, and what IT teams should patch first.
What the Outlook zero-day does
In its security advisory, Microsoft describes the flaw in one line: “Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.” Its FAQ explains the attack. An attacker “could send a specially crafted message file and convince a user to open it”. Opening it “could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning”.
What leaks is the user’s NTLMv2 hash, a scrambled version of their Windows login. Microsoft says the attacker “could use this to authenticate as the user”. CSO Online notes the hash may be relayed to other systems to sign in, or cracked to recover the password. For a company, that can be a foothold into email, file shares and other systems.
There are limits. The victim has to open the file; Microsoft says “the Preview Pane is not an attack vector”, so simply seeing a message in the reading pane doesn’t trigger it. Microsoft rates the bug only “Moderate”, with a CVSS score of 6.5 out of 10. But its advisory marks it as exploited, and the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on 10 November, giving US federal agencies until 24 November to patch.
Microsoft hasn’t said who is exploiting it, how many people were targeted, or how the files were delivered. As SecurityWeek reports, the advisory “provides no information about the observed attacks”. The advisory credits “Benoit Sevens using Claude with Anthropic” and a researcher called “nono” with reporting it.
Which versions are affected, and the builds that fix it
Microsoft’s advisory lists Outlook in three products, in both 32-bit and 64-bit editions: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The patched builds are:
- Office LTSC 2021: build 16.0.14334.21048 or later.
- Office LTSC 2024: build 16.0.17932.21140 or later.
- Microsoft 365 Apps: depends on update channel. Microsoft’s Office security updates page lists the 10 November fixes as Current Channel Version 2610 (Build 20527.20196) and Monthly Enterprise Channel Version 2610 (Build 20527.20194), with matching builds for older supported versions and the Semi-Annual Enterprise Channel. CVE-2026-124194 is listed among that release’s Outlook fixes.
The same page lists Office 2024 and Office 2021 retail copies on Build 20527.20196, though the advisory itself names only the enterprise and LTSC editions. The advisory doesn’t list Outlook for Mac, Outlook on the web or the mobile apps. To check your version in Outlook for Windows, go to File > Office Account and look under Product Information.
How to update Office now
Installing Windows updates isn’t enough here, because the Outlook fix comes through Office’s own updates. Malwarebytes‘s guidance covers how to check manually:
- Open an Office app such as Word or Outlook.
- Go to File > Account (in Outlook, File > Office Account).
- Under Product Information, choose Update Options > Update Now. If you only see Enable Updates, select that first.
- Save your work if prompted. When the update finishes, check that the build number matches or is newer than those above.
On a work computer, the update controls may be missing because IT manages updates centrally. In that case, check with your IT team rather than trying to work around it. Until the patch is installed, be wary of unexpected attachments or message files, even ones that seem to come from someone you know.
The rest of November’s Patch Tuesday
Outlook is the only flaw Microsoft lists as exploited this month, but the overall release is huge. Counts differ depending on how they’re tallied: Tenable counts 1,093 CVEs, SecurityWeek and CSO Online 1,094, and our own count of the Microsoft-assigned entries in Microsoft’s November release data came to 1,095. That data also republishes vulnerabilities from Chrome, Linux and other third parties, which is why some outlets report larger totals. SecurityWeek says October’s release was a record 1,413.
By Microsoft’s ratings, around 64 of its own bugs are Critical, mostly remote code execution flaws. Several of the most serious have a CVSS score of 9.8 and need no sign-in or user interaction, including bugs in Windows LDAP (CVE-2026-119958), Windows DNS (CVE-2026-88218), Windows DHCP Server (CVE-2026-88243) and Windows Search (CVE-2026-116928). Malwarebytes notes that Microsoft describes a Windows Search attack in which an email attachment indexed by Exchange Server could be enough, without anyone opening it. Microsoft rates exploitation of these as “less likely” and hasn’t reported any attacks.
For Windows 11 versions 24H2, 25H2 and 26H2, Microsoft’s release data lists the cumulative update as KB5132061. Microsoft’s lifecycle page shows that support for Windows 11 version 23H2 Enterprise and Education ends this month, making November its last regular security update. Windows 10 PCs only get these fixes through Extended Security Updates; our Windows 10 ESU guide explains how Australians can stay covered.
What Australian organisations should do
The Australian Signals Directorate’s Essential Eight maturity model puts office productivity suites and email clients in the same category as web browsers. At Maturity Level Three, patches for them are to be applied “within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist”. Levels one and two allow two weeks. This Outlook flaw is rated Moderate, but it is being exploited, so the 48-hour clock applies at level three. Counting from release (early 11 November AEDT), that’s around Friday 13 November.
Our read: don’t let the 6.5 score set the priority. Stolen login hashes are a well-worn way into corporate networks, which is why exploited Outlook bugs of this kind tend to be worth treating as urgent. Patch Outlook across the fleet first, because it’s the bug with confirmed attacks, then move on to domain controllers, DNS and DHCP servers and anything exposed to the internet. As longer-term hardening, many organisations block outbound SMB traffic (TCP port 445) to the internet and restrict NTLM where they can, which limits where a stolen hash can be sent. Home users mainly need to run the Office update and restart.
It’s the second urgent patch this week, after Chrome’s latest zero-day. If you missed the last big Microsoft release, our September Patch Tuesday report covers what was fixed then.
Details in this article come from Microsoft’s security advisory, release data and Office update notes, CISA’s catalog, the ASD and the independent reports linked above, as published between 10 and 12 November. Microsoft may update its advisory if more becomes known about the attacks.
Featured image: Building 92, the Microsoft visitor centre at the company’s headquarters in Redmond, Washington, May 2016. Photo: Coolcaesar via Wikimedia Commons, licensed under CC BY-SA 4.0; resized to 1200×800 and converted to PNG. The adapted image is shared under the same licence. Microsoft trademarks shown are for editorial purposes and do not imply endorsement.
