Outlook zero-day leaks Windows sign-in hashes, update Office now

On 10 November 2026, Microsoft released its November security updates, including a fix for CVE-2026-124194, a flaw in Outlook that Microsoft says is already being exploited. A specially crafted message file, once opened, can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. That leaks the user's NTLMv2 hash, which an attacker could use to authenticate as that user. It affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and Office LTSC 2021. Microsoft marks the flaw as "Exploitation Detected", and CISA added it to its Known Exploited Vulnerabilities catalogue the same day.

The bugs

CVE-2026-124194, Outlook connects out without warning and leaks the user's NTLMv2 hash. Microsoft calls this a spoofing flaw: Outlook does not warn the user before an unsafe action. Microsoft rates it Moderate, with a CVSS 3.1 base score of 6.5.

An unauthenticated attacker has to send the victim a malicious file and convince them to open it in an affected version of Outlook. Microsoft says the Preview Pane is not an attack vector, so the file has to be opened. Once it is, the leaked NTLMv2 hash can be used to sign in as that user to other services that accept it.

Microsoft says the flaw was not publicly disclosed before the fix. Its advisory gives no detail about who is behind the attacks or how many organisations have been hit. The low score reflects the need for a user to open a file; it is still being used in real attacks, and Outlook is on most business Windows desktops.

The remedy

A fix is available, and installing the November 2026 Office security update is the complete fix.

The fixed builds are:

• Office LTSC 2024 (volume licensed): Version 2408, build 16.0.17932.21140.
• Office LTSC 2021 (volume licensed): Version 2108, build 16.0.14334.21048.
• Microsoft 365 Apps for Enterprise: the 10 November 2026 security release for your update channel. Microsoft lists Current Channel Version 2610 (Build 20527.20196); Monthly Enterprise Channel Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264) and Version 2608 (Build 20326.20320); and Semi-Annual Enterprise Channel Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262) and Version 2608 (Build 20326.20318).

Microsoft 365 Apps and other Click-to-Run installs usually update on their own, but the new build is only used after Outlook and the other Office apps restart. To confirm, open Outlook, go to File, then Office Account, and check the version and build shown under About Outlook. It should match or be later than the build listed above for your edition and channel.

If you cannot update today

No setting makes an unpatched Outlook safe, and Microsoft's advisory lists no workaround or mitigation. The only thing the advisory points to is that the attack needs a user to open a malicious file, and the Preview Pane alone does not trigger it, so remind staff not to open unexpected message files or Office attachments until the update is in place.

Sources

• Microsoft Security Response Center: CVE-2026-124194
• Microsoft: Release notes for Microsoft 365 Apps security updates
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog