Microsoft fixed an Outlook zero-day that attackers are already exploiting in its November Patch Tuesday, which patched 1,094 flaws.
The bug, CVE-2026-124194, can leak your NTLMv2 hash. Microsoft says an unauthenticated attacker could send a specially crafted message file. Opening it in an affected Outlook version could make the app connect to an attacker-controlled location without the usual warning about external content. Microsoft rates the flaw Moderate, with a CVSS score of 6.5.
Don’t let the low score fool you.
Nick Carroll, cyber incident response manager at Nightwing
CSO Online, which counts the 1,094 fixes, warns that an attacker could pass the hash to other machines to log in as the user. They could also crack it to recover the password. The user has to open the file, and Microsoft excludes the Preview Pane as a trigger. It hasn’t said who is behind the attacks or how many targets were hit.
The US cybersecurity agency CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November, with a federal deadline of 24 November.
How to update Outlook
The fix doesn’t come through Windows Update. It ships in the Microsoft 365 Apps and Office LTSC 2021 and 2024 security updates, so Outlook itself requires updating. In Outlook or Word, go to File > Account > Update Options > Update Now. In classic Outlook, the path is File > Office Account, then Update Options > Update Now if available.
If the Update Options button is missing or greyed out, your organisation manages updates. The fixed builds are 16.0.17932.21140 for Office LTSC 2024 and 16.0.14334.21048 for LTSC 2021. Microsoft’s Office release notes list Microsoft 365 Apps builds by channel. Until the update is in, don’t open attachments or message files you weren’t expecting, even when the sender looks familiar.
Windows and the other fixes
For Windows 11 25H2 and 26H2, the update is KB5132061, installed from Settings > Windows Update followed by a restart. It also covers 24H2 (build 26100.9974) but doesn’t contain the Outlook fix.
Jack Bicer of Action1 says four other flaws score 9.8 on CVSS. They include CVE-2026-119958 in Windows LDAP, putting domain controllers at risk, and CVE-2026-118207 in Exchange Server, triggered by anyone able to send email to an organisation. Bicer’s advice is to patch domain controllers and Exchange servers first.
BleepingComputer’s count is higher, at 1,235. Shattered says some outlets’ higher counts include Edge fixes. In September, Microsoft fixed 974 CVEs. The next Patch Tuesday is on 8 December.
