This article was written with the help of AI. We used an AI assistant to draft it, then checked every detail against Microsoft's advisory and CISA's catalog. Sources are linked throughout.
Microsoft's November 10, 2026 security updates include a fix for an Outlook zero-day, CVE-2026-124194, that attackers were already using. Microsoft's advisory lists it as "Exploitation Detected," and CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a November 24, 2026 deadline for federal agencies.
Your business is not bound by that federal deadline, but it is a good yardstick. If CISA expects agencies to be patched in two weeks, a small office should aim for the same.
What the Flaw Does
Microsoft calls it a spoofing vulnerability. In plain terms, according to the advisory:
- An attacker sends a specially crafted file and convinces someone to open it in Outlook.
- Opening it makes Outlook connect to a network location the attacker controls, without showing the usual external-content warning.
- That connection hands over the user's NTLMv2 hash, a scrambled form of their Windows sign-in credential, which Microsoft says the attacker could use to authenticate as that user.
Two details matter for how worried to be. Microsoft says the Preview Pane is not an attack vector, so someone has to open the file. And Microsoft rates it "Moderate" with a CVSS score of 6.5. A moderate rating on a bug that is being used in real attacks still deserves a quick patch.
Which Versions Get the Fix
Microsoft's advisory lists these products and fixed builds:
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): see Microsoft's Office security release notes for the build on your update channel.
- Office LTSC 2024 (32-bit and 64-bit): build 16.0.17932.21140.
- Office LTSC 2021 (32-bit and 64-bit): build 16.0.14334.21048.
If you run an older perpetual Office version that is not on that list and is out of support, that is a bigger problem than this one bug. It will not get fixes for the next one either.
What to Do This Week
1. Confirm the update actually landed
In Outlook, go to File > Office Account and look at the version and build under About Outlook. Choose Update Options > Update Now if it is behind. Click-to-Run Office updates in the background, but a PC that is never restarted, or one whose updates were turned off years ago, can sit on an old build for months.
2. Check the machines nobody thinks about
The front-desk PC, the shared computer in the shop, the laptop of the person who works from home. These are the ones that usually turn out to be behind.
3. Tell staff what to watch for
The attack needs someone to open a file they were sent. A short note to staff helps: do not open unexpected attachments, even from people you know, without checking with the sender another way. Our guide to stopping phishing attacks has more on what to look for.
4. Make stolen hashes less useful
A leaked NTLMv2 hash is worth less when your accounts use MFA and when you have cut back on old NTLM sign-ins inside your network. If you are not sure where you stand, our Microsoft 365 security baseline is a good starting list.
Sources
- Microsoft Security Response Center: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability
- CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-124194 added November 10, 2026)
- NIST National Vulnerability Database: CVE-2026-124194
- Microsoft: Office security release notes
Common questions
Can someone get hit just by previewing an email?
Microsoft says no. Its advisory states the Preview Pane is not an attack vector for CVE-2026-124194. The user has to open a malicious file the attacker sent.
What does the attacker get?
Microsoft says the flaw discloses the user's NTLMv2 hash, which the attacker could use to authenticate as that user. Opening the file makes Outlook connect to an attacker-controlled network location without the usual external-content warning.
Is this being used in real attacks?
Yes. Microsoft marks it "Exploitation Detected," and CISA added it to its Known Exploited Vulnerabilities catalog on November 10, 2026.
We use Microsoft 365 Apps. Do we have to do anything?
Microsoft 365 Apps update themselves on most PCs, but only when the update channel is working and Outlook gets restarted. Check that each PC is on a current build rather than assuming it is.
