Outlook zero-day fixed in November 2026 updates
Microsoft has patched an Outlook flaw already used to steal sign-in hashes. What CVE-2026-124194 does and what a small office should update this week.
Microsoft released its November 2026 security updates on Tuesday, November 10, and one of the fixes is for a flaw in Outlook that attackers were already using. It is tracked as CVE-2026-124194. If your business runs Outlook on Windows, as most Microsoft 365 offices do, this is the update to make sure lands this week.
What the Outlook flaw does
Microsoft classes CVE-2026-124194 as a spoofing vulnerability. According to BleepingComputer, an attacker sends a specially crafted message file and persuades someone to open it in Outlook. Outlook then connects to a location the attacker controls without showing its usual warning about external content, and in doing so hands over the user's NTLMv2 hash, a scrambled form of their Windows sign-in credentials.
SecurityWeek reports that Microsoft rates the flaw "moderate" with a CVSS score of 6.5, that it cannot be triggered through the Preview Pane, and that the affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft says the flaw has been exploited but its advisory gives no details about the attacks. The bug was not publicly known before the fix was released.
Why a "moderate" bug still matters
The rating reflects that someone has to open the file. In a small office that is not much of a barrier: a convincing email with an attachment that looks like an invoice or a voicemail is enough. A stolen NTLMv2 hash can be used to sign in as that person on systems that still accept NTLM, and if the password behind it is weak, the hash can often be cracked offline. That turns one click into access to file shares, a server or other machines on the office network.
The rest of this month's release
It is a very large update. BleepingComputer counts 1,235 flaws and SecurityWeek 1,094, the difference coming from how each outlet counts. SecurityWeek notes critical-severity fixes for Windows 10 and 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition and Edge. BleepingComputer lists critical fixes in Windows Active Directory Domain Services, which matters if you run your own domain controller. SecurityWeek also notes these are the final updates for the Enterprise and Education editions of Windows 11 version 23H2.
What to do this week
- Update Office on every PC. Microsoft 365 Apps usually update on their own, but not always promptly. In Outlook, go to File, Office Account, Update Options, Update Now, then restart Outlook. Check the PCs that are rarely used or rarely restarted.
- Install the Windows updates on desktops, laptops and any servers, and restart them. If you manage updates centrally, check the report rather than assuming they installed.
- Remind staff about unexpected attachments, especially message files (.msg or .eml) and anything that arrives as "a copy of an email". If in doubt, they should ask before opening it.
- Block outbound SMB at the firewall (TCP port 445 to the internet), if it is not already blocked. Hash-leak attacks like this one generally rely on the PC reaching out to an attacker's server.
- Use long, unique passwords for Windows and Microsoft 365 accounts, so that a captured hash is much harder to crack.
- If someone opened a suspicious file recently, change their password and look at recent sign-ins for that account.
Earlier this month we wrote about a different route into Microsoft 365 accounts in token replay attacks that MFA did not stop. Our patch management and phishing and email security pages explain how we keep updates and email protection under control for small businesses. If you are not sure your office is up to date, call (213) 986-4855.