Microsoft released its monthly security updates on November 10. The list runs to more than a thousand flaws, but for businesses the most urgent one this month is CVE-2026-124194 in classic Outlook. Microsoft has confirmed it is already being used in real attacks, and the US agency CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.
The attack works like this: the user receives a specially crafted message file. When the file is opened, Outlook connects to the attacker's server without the usual warning, and the user's NTLMv2 hash is sent along the way. With it, an attacker can try to crack a weak password offline or sign in to other services as that user. Viewing the item in the Preview Pane does not trigger the attack; the file has to be opened.
Microsoft rates the flaw as "moderate" with a score of 6.5. Because it is being exploited, though, it should not wait until next month. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 are affected.
The key point is this: the fix comes through Office's own update channel, not Windows Update. A computer can look fully up to date on the Windows side while Outlook stays vulnerable. On a single PC, go to File > Account > Update Options > Update Now in Outlook and reopen the Office apps. In a company, roll out the November Office update with Intune, Configuration Manager or whatever tool you use, then check that devices actually reached the new build.
It is also worth reminding staff not to open unexpected message file attachments, especially from senders they don't know.
Sources: SecurityWeek, WindowsForum, Netizen.
