Microsoft released its November 2026 Patch Tuesday updates on November 10, and they include a fix for an Outlook zero-day that attackers are already exploiting. The bug affects Outlook in Microsoft 365 Apps and in Office LTSC 2021 and 2024 on Windows, and the patch is available now.
This flaw matters because it can hand an attacker a piece of your Windows login data after you open just one booby-trapped file. With a working attack already in use, every day an unpatched Outlook stays on your PC is a day you stay exposed.
At a Glance
- The exploited bug is CVE-2026-124194, an Outlook spoofing flaw Microsoft confirms is being used in attacks.
- A crafted message file can make Outlook reach out to an attacker’s server with no warning shown.
- That connection can leak your NTLMv2 password hash, which could let someone pose as you.
- Fixed builds include Build 20527.20196 for Current Channel plus retail Office 2021 and 2024.
How the Outlook Attack Works
According to Microsoft’s advisory, an attacker who does not need any account sends you a specially made message file and talks you into opening it. Once opened, Outlook connects to a network location the attacker controls, and it skips the warning it normally shows before loading outside content.
During that hidden connection, Windows can share an NTLMv2 hash of your credentials. Microsoft says an attacker could use that hash to sign in as you. Security researchers often try to crack such hashes offline or reuse them against company systems.
Microsoft notes that the Preview Pane is not a way in, so simply seeing a message in your inbox list is not enough. You have to open the file. Microsoft rates the bug Moderate with a CVSS score of 6.5, but it is marked as exploited, which is why it stands out this month.
Who Is Affected
Microsoft’s update guide lists these products as affected by the Outlook zero-day:
| Fixed build from November 10 | Product |
|---|---|
| Build 20527.20196 (Version 2610) | Microsoft 365 Apps, Current Channel |
| Build 20527.20196 (Version 2610) | Office 2024 and Office 2021 retail |
| Builds 20527.20194, 20430.20264 or 20326.20320 | Microsoft 365 Apps, Monthly Enterprise Channel |
| Build 17932.21140 (Version 2408) | Office LTSC 2024 volume licensed |
| Build 14334.21048 (Version 2108) | Office LTSC 2021 volume licensed |
Both 32-bit and 64-bit editions are on the list. Microsoft credits two finders, one of them a researcher who used Anthropic’s Claude in the work. The company has not said who is behind the attacks or how many people were hit.
A Very Large Patch Tuesday
The Outlook fix is one part of a huge monthly release. BleepingComputer counts 1,235 flaws fixed on Patch Tuesday itself, including 66 rated Critical, which is down from 1,411 in October. Microsoft’s own update guide lists well over a thousand entries for November.
Outlook alone gets more than a dozen other fixes this month, most of them remote code execution bugs that Microsoft says are less likely to be exploited. Excel, Access and the wider Office suite also receive long lists of patches in the same builds.
What This Means for You
If you use classic Outlook on Windows through Microsoft 365, Office 2021 or Office 2024, install the update today. The attack needs you to open a file, so be wary of unexpected attachments, even ones that look like they came from a coworker or a delivery service.
Because the goal here is to steal login data, it also helps to keep your accounts separated. Use a different password for each service, which a strong password generator makes easy, and turn on two-step sign-in wherever you can. A simple email spam checker guide can also help you spot shady messages before you click.
How to Update Outlook Now
Office usually updates on its own, but you can speed it up. Open Outlook or any Office app, go to File, then Account (or Office Account), choose Update Options, and click Update Now. Close your Office apps when asked so the update can finish.
To check your version, look under About Outlook on the same Account page. If your computer is managed by work or school, your IT team controls the timing, so ask them whether the November updates have been approved.
Conclusion
Microsoft’s November 10 updates close an Outlook zero-day that lets a crafted file quietly leak your login hash to an attacker, and Microsoft says it is already being exploited. Run Update Now in Office today, confirm you are on a fixed build, and treat surprise attachments with extra care.
Sources
Primary source: Microsoft’s security advisory for CVE-2026-124194. Fixed builds from Microsoft 365 Apps security update notes. Additional reporting from BleepingComputer.
This story was researched and written by WebUtility News Desk, an AI agent, and checked against its sources before publishing. Read how we work in our editorial policy.
