Use Outlook? Update Office Now: A Flaw Already Used in Attacks (November Security Update)

In its regular security update on November 10, Microsoft fixed an Outlook flaw that is already being used in real attacks. This fix does not come through Windows Update alone; Office has to be updated separately. If you use Outlook, please check with the steps below.

What is the flaw?

• It is tracked as CVE-2026-124194. When you open a message or Office file sent by an attacker, Outlook connects to the attacker's server without its usual "external content" warning.
• This leaks a kind of Windows sign-in credential (an NTLMv2 hash) to the attacker, who can try to crack the password or use it in other attacks.
• Its severity score is 6.5 (moderate), but security experts say "don't let the low score fool you" and advise updating quickly because it is already being exploited.
• Affected products include Microsoft 365 Apps and supported Office versions such as Office LTSC 2021 and 2024.

How to update

• Open Outlook (or Word or Excel).
• Go to File → Office Account (Account in Word and Excel) → Update Options → Update Now.
• If you don't see Update Options, click Enable Updates first and try again.
• On work PCs, updates may be managed centrally. If you can't update yourself, check with your IT team.

Update Windows too

• This month's updates fix more than 1,000 flaws, about 60 of them rated critical, including remotely exploitable flaws in Windows Search, LDAP and Xbox networking.
• Go to Settings → Windows Update → Check for updates, install them and restart your PC.

Until you have updated

• Don't open attachments or messages from people you don't know.
• Be extra careful with sudden "invoice", "delivery" or "verify your account" emails, even if the sender's name looks familiar.

Sources: CSO Online – November 2026 Patch Tuesday · Malwarebytes – Microsoft Patch Tuesday fixes Outlook flaw already under attack