Outlook vulnerability CVE-2026-124194 is being exploited: update Office now

Microsoft says attackers are already exploiting an Outlook flaw, CVE-2026-124194, and the US cybersecurity agency CISA added it to its list of known exploited vulnerabilities on Nov. 10. The fix came out the same day in Microsoft's Patch Tuesday updates, so the action is simple: update Office now. Microsoft's security advisory says customer action is required.

Fixed Office builds and how to check yours

Open any Office app, go to File, then Office Account (or Account), and look under Product Information or About. "About Outlook" shows your full version and build number and whether you run 32-bit or 64-bit. The same page shows your update channel. Microsoft explains this on its Office version page.

Compare your build with these:

The Microsoft 365 Apps builds are the ones in Microsoft's Nov. 10 release notes, which list CVE-2026-124194 under Outlook. The page does not match the CVE to a specific build, so confirm your channel there. Compare against the row for your own version number, since the enterprise channels list a build for each of 2610, 2609 and 2608. If your build is older than the one for your product, install the latest Office update. Microsoft's advisory points Microsoft 365 Apps users to that same release-notes page.

What Microsoft and CISA say

Microsoft calls it a "Microsoft Outlook Spoofing Vulnerability" and scores it 6.5 (Moderate). It marks the flaw as exploited, but not publicly disclosed.

According to Microsoft, an attacker with no account sends a specially crafted message file, and the target has to open it. Outlook then connects to a location the attacker controls, without the usual warning about external content. That hands over the user's NTLMv2 hash, a scrambled form of the sign-in password that an attacker can use to authenticate as that user. Microsoft says the Preview Pane is not an attack path, so a message must be opened, not just selected.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10. US federal agencies must fix it by Nov. 24. The catalog lists known ransomware use as "unknown."

Who is affected

Microsoft's advisory lists Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise. The new Outlook and Outlook on the web are not listed. That is not the same as being cleared, and we have not found a Microsoft statement about either.

What we do not know

• Who is attacking: Microsoft and CISA name no attackers, targets or campaigns, and we have seen no public reports of any.
• Ransomware: CISA's catalog says "unknown."
• Build mapping: the release-notes page lists the CVE but does not tie it to specific builds.
• Other Office versions: the advisory's product list is the three above. We have no word on anything else.

For IT admins

Microsoft documents a Windows policy, "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers," that can audit or deny outgoing NTLM traffic. Microsoft warns it can break compatibility and advises auditing first and building an exception list. This is general hardening Microsoft describes, not something the advisory lists as the fix for this CVE. The policy documentation has the details.

What we checked

On Nov. 11, 2026 we read the Microsoft Security Response Center record for CVE-2026-124194 through its CVRF feed, because the update-guide page itself needs JavaScript to load. We also read the CISA Known Exploited Vulnerabilities catalog entry, Microsoft's Nov. 10 Microsoft 365 Apps release notes, and Microsoft's Office version page. We did not install the update or test the flaw, and we did not verify how any individual build maps to this CVE beyond what those pages state.

Related: Microsoft Authenticator Android flaw let apps steal work tokens | Android's November security update fixes 216 flaws | Some Windows PCs lose Windows Update in 2027 without a patch