Microsoft released its November 2026 security updates on Tuesday, November 10. Among them is a fix for CVE-2026-124194, a Microsoft Outlook flaw that Microsoft says was already being used in attacks. CISA added it to its Known Exploited Vulnerabilities catalog the same day.
The short version: make sure Office (including Outlook) and Windows on every company computer install this month's updates, and remind staff not to open unexpected message files sent as attachments.
What the flaw does
According to Microsoft, an attacker can send a specially crafted message file and convince someone to open it in Outlook. Opening it can make Outlook connect to a location the attacker controls without showing the usual warning about external content. That connection can leak the user's NTLMv2 hash, a scrambled form of their Windows sign-in, which an attacker could use to pose as that user. Microsoft says it cannot be triggered just by viewing a message in the Preview Pane; the file has to be opened.
Microsoft rates it moderate (CVSS 6.5), but because it is already in use, it is worth treating as urgent. CISA set a federal remediation due date of November 24, 2026.
Who is at risk
Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected. Businesses on Microsoft 365 whose computers are set to update automatically should receive the fix on their own, but it is worth confirming, especially on PCs that are rarely restarted or that have updates paused.
What to do this week
- Update Office on every computer. In Outlook, go to File, then Office Account, then Update Options, and choose Update Now. Microsoft's release notes list the fixed builds, for example Office LTSC 2024 build 17932.21140 and Office LTSC 2021 build 14334.21048.
- Install the November Windows updates and restart, since this month's release also fixes many Windows flaws.
- Remind staff not to open message files or other attachments they were not expecting, even if they appear to come from someone they know.
- Ask your IT provider about NTLM. Blocking outbound file-sharing traffic (SMB, TCP port 445) at the firewall and reducing reliance on NTLM sign-ins makes this kind of attack much harder.
Questions to ask your IT provider
- Have all our computers installed the November 2026 Office and Windows updates?
- Are any PCs set to defer or pause updates?
- Does our firewall block outbound SMB to the internet?
Not sure every PC in the office actually installed this month's Office and Windows updates? We can check update status across your computers and Microsoft 365, and tighten email attachment rules. Call 713.980.2000 or send us a note.
Let's Talk →