Outlook vulnerability is being actively exploited – update Office now

What happened?

On November 10, Microsoft released a security update for Outlook. It fixes a vulnerability tracked as CVE-2026-124194, and Microsoft has confirmed that it has already been exploited in attacks.

The attacker sends a specially crafted message file and gets the recipient to open it. Outlook then connects to an address the attacker controls, without the usual warning about external content. During that connection, Windows can send the user's sign-in credentials in encrypted form, known as an NTLMv2 hash. The attacker can use it to sign in as the user.

Viewing the message in the preview pane is not enough to trigger the attack. The user has to open the file itself.

Who is affected?

Microsoft lists these products as vulnerable:

• Microsoft 365 Apps for Enterprise
• Office LTSC 2024
• Office LTSC 2021

That means the classic Outlook app on Windows, which most businesses still use. The most exposed are businesses with on-premises servers and on-premises sign-in, because that is where stolen NTLM data is most valuable.

Why "moderate" does not mean it can wait

Microsoft rates the vulnerability as moderate severity, with a CVSS score of 6.5 out of 10. The score is low because the attack requires someone to open a file. But the vulnerability is being used in real attacks, and getting an employee to open an attachment is exactly what phishing is designed to do.

The fix is in Office, not in Windows

The update comes through Office, not through Windows Update alone. That means a PC can be up to date in Windows and still be vulnerable. In Outlook, select File, Office Account, Update Options, and then Update Now.

Businesses that manage updates centrally in Intune should confirm that the November release has actually been deployed to every device, including those that are rarely turned on.

Microsoft's security advisory for CVE-2026-124194