If your team uses Outlook on Windows computers, update Office today. On 10 November 2026, Microsoft fixed an Outlook zero-day vulnerability (CVE-2026-124194) that attackers were already using before the fix came out. A booby-trapped file can make Outlook quietly hand over a scrambled copy of the user’s Windows login. An attacker could use that to sign in as that person.
This post explains what happened, who is affected, and the short list of things to do this week. It is written for business owners and office managers, not IT specialists.
What happened
Microsoft released its monthly security updates, known as Patch Tuesday, on 10 November 2026. It was a very large release. BleepingComputer counted 1,235 flaws fixed. One stood out because Microsoft marked it “Exploitation Detected”, meaning real attackers had used it.
Here is what is confirmed from Microsoft’s own advisory and the US Cybersecurity and Infrastructure Security Agency (CISA) catalogue of exploited flaws:
| Detail | What the official sources say |
|---|---|
| Name | Microsoft Outlook Spoofing Vulnerability, CVE-2026-124194 |
| Fixed on | 10 November 2026 |
| Being exploited? | Yes. Microsoft lists it as “Exploitation Detected”, and CISA added it to its exploited list the same day |
| Microsoft’s rating | Moderate, with a score of 6.5 out of 10 |
| Affected products | Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit) |
| Deadline for US federal agencies | 24 November 2026 |
Not yet known: Microsoft and CISA have not said publicly who is behind the attacks, who was targeted or how widespread they are. CISA lists ransomware use as “unknown”. This could change, so check the advisory again later this month.
Don’t be put off by the “Moderate” label. Microsoft rates it lower because someone has to open a file before anything happens. But attackers are already using it, and their usual trick is to get someone to open a file.
Why it happened, in plain English
To understand this flaw, you need to know one old Windows habit.
When a Windows computer connects to a shared network folder, it proves who you are automatically. It doesn’t type your password. Instead, it sends a scrambled response worked out from your password. This system is called NTLM, and the scrambled response is often called a “hash”. Inside an office network this is normal, and it is why shared drives open without asking you to log in every time.
The danger comes when a computer sends that response to a server on the internet that belongs to an attacker. Outlook is supposed to protect you here. When a message tries to pull in content from outside, Outlook normally shows a warning and blocks it until you agree.
According to Microsoft, this flaw skips that warning. If a user opens a specially crafted message file, Outlook “could connect to an attacker-controlled network location without displaying the usual external-content warning”. That connection can leak the user’s NTLMv2 hash, which, in Microsoft’s words, the attacker “could use to authenticate as the user”.
In practice, an attacker with that hash can try to crack it offline to recover the password. Short or common passwords fall quickly. Or they can try to use it to get into other systems as that member of staff.
Two details matter for how worried to be:
- Someone has to open the file. Microsoft says the attacker “must send a user a malicious Office file and convince them to open it”.
- The Preview Pane is not an attack route. Microsoft confirms that just seeing a message in Outlook’s reading pane does not trigger it.
So the attack depends on the oldest trick there is: an email that makes someone want to open the attachment. Think of “Revised invoice”, “Payment confirmation” or “Updated staff list”.
Who is affected
You should act if anyone in your organisation uses classic desktop Outlook on a Windows PC from one of these:
- A Microsoft 365 subscription that includes the desktop Office apps
- Office LTSC 2021 or Office LTSC 2024, which are common in organisations that buy Office once rather than by subscription
Microsoft’s affected list does not name Outlook on the web, the Outlook phone apps or Outlook for Mac. That is a good reason to deal with Windows PCs first.
A warning for older offices. If your office or school still runs Office 2016 or Office 2019, take note. Both reached end of support on 14 October 2025. Microsoft doesn’t list them as affected by this flaw, but that does not mean they are safe. Software that is out of support stops getting regular security fixes, so the next flaw may never be fixed on those machines.
What to do now
These are defensive steps only. Most small offices can finish steps 1 and 2 today.
1. Update Office on every Windows PC
The fix comes through Office updates. The usual monthly Windows update is not enough on its own. On each PC, Microsoft’s instructions are:
- Open Word or another Office app.
- Go to File > Account. In classic Outlook it is File > Office Account.
- Choose Update Options > Update Now. If you only see “Enable Updates”, click that first.
To check a machine is fixed, look at the build number on the same Account screen. Microsoft’s release notes list the November fixed versions. For example, Current Channel is version 2610, build 20527.20196. Office LTSC 2024 is build 17932.21140, and Office LTSC 2021 is build 14334.21048.
2. Brief your staff in two minutes
Tell everyone not to open unexpected attachments, especially saved email or message files, even if the sender looks familiar. If an email about money or passwords seems urgent, call the sender on a number you already have before you act on it.
3. Block outbound file-sharing traffic at your router or firewall
This attack needs the PC to reach a file-sharing server on the internet, which uses TCP port 445. Microsoft’s own guidance is to “block TCP port 445 outbound to the internet at your corporate firewall”, and it notes that few businesses need that traffic. Ask whoever manages your network to confirm the block is in place. If you use Azure Files, check with them first.
4. Make stolen hashes less useful
A long, unique password is much harder to crack from a captured hash than a short one. Turning on multi-factor sign-in for Microsoft 365 adds a second barrier. Neither replaces the update, but both cut the damage if something slips through.
5. If someone already opened a strange file
Change that person’s password straight away, starting with their Windows or Microsoft 365 account. Then have your administrator review recent sign-in activity for anything unusual.
Kotlead’s view
This section is our opinion.
The fix here is simple. The hard part is knowing that every PC in the building actually received it. All it takes is one machine with updates switched off, a “temporary” copy of Office that was never licensed properly, or a laptop that stays at home and never syncs. That one machine is where an attacker gets in.
If you can’t say with confidence which version of Office each of your computers runs, this week is a good time to find out. Write it down once, keep it updated, and the next urgent patch will take minutes rather than days. The same logic applied to the WordPress flaw we covered earlier this month: these fixes mostly come down to knowing what you run.
Email security also goes beyond patches. If your messages are also landing in customers’ spam folders, it is worth reviewing your whole email setup, not just Outlook. Through our Tech Concierge service, Kotlead handles Microsoft 365 setup, technical support and security basics like safer logins and sensible staff access for businesses that don’t have an IT department.
Frequently asked questions
What is the Outlook zero-day vulnerability of November 2026?
It is CVE-2026-124194, a flaw in desktop Outlook that Microsoft fixed on 10 November 2026. Attackers were using it before the fix. A crafted message file can make Outlook leak the user’s NTLMv2 login hash to an attacker’s server without the usual warning.
Is Outlook on my phone or on the web affected?
Microsoft’s affected product list names only Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 on Windows. Outlook on the web, the phone apps and Outlook for Mac are not on that list.
Does Windows Update fix it?
Not on its own. The fix comes through Office updates. In any Office app, go to File > Account > Update Options > Update Now, or make sure your administrator has pushed the November Office update.
We still use Office 2016 or 2019. Are we safe?
Those versions aren’t listed for this flaw, but both reached end of support on 14 October 2025. Plan an upgrade, because future flaws may not be fixed for them.
Not sure every PC in your office is updated?
Tell us what you run, and we’ll help you work out what needs fixing and in what order. Book a free 15-minute call.
Featured photo by geralt on Pixabay.