Opening one bad file in Outlook can leak your login to an attacker, and Microsoft says that’s already happening. I’d install the fix before you open another file someone sends you.
What’s wrong
On Nov 10, Microsoft released a fix for a flaw in Outlook and marked it as already being used in real attacks. The same day, CISA (the federal government’s cybersecurity agency) added it to its list of flaws known to be used by attackers.
Here’s how it works. Someone sends you a specially made message file and talks you into opening it in Outlook. When you open it, Outlook connects to a computer the attacker controls, and it skips the warning it normally shows before loading anything from outside. That connection can leak the scrambled login information Windows uses to prove who you are, and the attacker can use it to sign in as you.
Seeing the email in Outlook’s preview pane does not trigger it. You have to open the file. The attacker doesn’t need to sign in to anything to try this.
How to fix it
A note if you use new Outlook: Microsoft’s list of affected versions covers classic Outlook in the Office desktop apps, not new Outlook for Windows. New Outlook is a separate app, and it checks for and installs its own updates when you open it. The steps below are for classic Outlook and the other Office apps.
Install the November 2026 Office security update. These are Microsoft’s steps for updating Office on Windows:
- Open any Office app, such as Word, and create a new document.
- Go to File > Account. If you opened classic Outlook, it’s File > Office Account.
- Under Product Information, choose Update Options > Update Now. If you don’t see Update Now, click Enable Updates first.
- When you see “You’re up to date!” or “Updates were installed,” close that window.
If you only see an About button and no Update Options, your company manages your Office updates. Ask your IT help desk to install the November 2026 Office security update. You can also try Microsoft Update, the Windows Update setting that also installs Office updates.
Microsoft’s full guide is here: How to update Microsoft 365 or Office for Windows
More info
Microsoft calls this the “Microsoft Outlook Spoofing Vulnerability,” and its CVE number is CVE-2026-124194 (a public ID that security folks use to track a specific flaw). Spoofing means pretending to be someone else, which is what the attacker gets to do once they have your login information.
Microsoft rates it Moderate, with a severity score of 6.5 out of 10. Don’t let “Moderate” fool you. Microsoft and CISA both say it is already being used in attacks, and Microsoft lists it as needing action from you, which means installing the update.
The flaw had not been made public before Microsoft released the fix.
The login information that leaks is called an NTLMv2 hash (a scrambled version of your Windows sign-in that Windows sends to prove who you are). Normally Outlook warns you before it reaches out to an outside location. This flaw lets a crafted file skip that warning.
Microsoft lists these versions as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (LTSC is the version businesses buy once instead of by subscription). Microsoft has not shared who is behind the attacks or how many people were hit.
You can read Microsoft’s own write-up on its CVE-2026-124194 page and its Microsoft 365 Apps security update release notes, the public CVE.org record, and CISA’s entry in its Known Exploited Vulnerabilities catalog.