Updated 11 November 2026. Microsoft has fixed a flaw in Outlook that attackers are already using. Opening a malicious Office file can hand an attacker a scrambled copy of your Windows sign-in, which they can use to pose as you. The fix is in Microsoft’s security updates released on 10 November.
At a glance
- What: a spoofing flaw in Microsoft Outlook, listed as CVE-2026-124194.
- Risk: opening a malicious Office file can leak your NTLMv2 hash, which an attacker can use to sign in as you.
- Severity: Moderate, 6.5 out of 10 on Microsoft’s own scoring. Microsoft marks it as exploited.
- Fix: Microsoft’s security updates released on 10 November 2026.
- Who has to act: anyone using Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024.
1. The problem
Microsoft’s November security updates, released on 10 November, fix an Outlook flaw listed as CVE-2026-124194. Microsoft’s advisory marks it as exploited, meaning attackers were using it before the fix arrived.
According to the advisory, an attacker sends a specially crafted file and persuades someone to open it in an affected version of Outlook. Opening it can make Outlook connect to a network location the attacker controls without showing the usual warning about outside content. That connection gives away the person’s NTLMv2 hash, which the attacker could use to authenticate as them. Microsoft says the Preview Pane is not a way in: the person has to open the file.
The advisory lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected. It gives no workaround, so installing the update is the fix.
2. What it means, in plain words
What a zero-day is
A zero-day is a flaw that attackers use before a fix exists. That was the case here, which is why this update should not wait.
What an NTLM hash is
NTLM is one of the ways Windows proves who you are on a network. Instead of sending your password, your computer sends a scrambled value, called a hash. Microsoft says an attacker who obtains that hash could use it to authenticate as you.
Who is affected, and who is not
You are affected if you use Outlook as part of Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 and have not yet installed the November update. Those are the products Microsoft’s advisory names. If you are not sure which Office you have, update anyway.
Receiving an email is not enough to trigger the flaw, and neither is seeing a file in the Preview Pane, according to Microsoft. Someone has to open the malicious file.
The AI angle
Microsoft’s advisory credits the researchers who reported the flaw, one of them acknowledged as working with an AI model. It is part of a much bigger shift. This month’s release fixes 1,093 vulnerabilities by Tenable’s count, after more than 1,400 in October, and Microsoft credits advances in AI for helping it find and fix so many bugs, according to Krebs on Security. A year ago, Krebs notes, Microsoft was averaging about 100 a month. AI is helping defenders find flaws far faster, but each one still has to be patched, and attackers move quickly once a fix is public.
3. What to do
- Check which Office you have. In Outlook, open File, then Office Account. The product name and version are shown under Product Information.
- Install the update. On the same screen choose Update Options, then Update Now. Let it finish, then restart Outlook. Run Windows Update as well, because the same monthly release also fixes Windows.
- On a work computer, your IT team usually controls updates. Ask them to confirm that the November 2026 Office security update is installed on your machine.
- If you cannot update today: Microsoft’s advisory gives no workaround. Until you can update, do not open Office files you were not expecting, even from people you know. This is a stopgap, not a fix.
- If you think you opened a suspicious file: install the update and tell your IT team, or whoever looks after your computer, straight away.