Outlook zero-day: updating Windows alone won't fix it. Here's what to do

The skim

• Fix this one first: Microsoft says attackers are already exploiting CVE-2026-124194, an Outlook for Windows flaw that can leak the password hash attackers use to impersonate you. It's the only bug in November's update that Microsoft marks as exploited.
• The catch: the fix ships in Office builds, not in the Windows cumulative update. Install Windows' Patch Tuesday update and Outlook can still be unpatched.
• Two minutes: in Outlook or Word, go to File > Account > Update Options > Update Now, then run Windows Update. Below is the rest of this week's update checklist, in priority order.

What Microsoft fixed, and why this bug matters

Microsoft's November security release came out on Tuesday, Nov. 10. The headline counts vary from outlet to outlet, from roughly 1,090 to more than 1,250 fixes. That's down to how each one tallies third-party and cloud entries. Krebs on Security counts 1,093, including 63 rated critical. The number to care about is one.

That's CVE-2026-124194, which Microsoft's advisory lists as "Exploited: Yes." Microsoft calls it a spoofing flaw in Outlook and explains the attack this way:

"An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user."

What leaks, Microsoft says, is your NTLMv2 hash, a scrambled form of your Windows sign-in credential. An attacker "could use this to authenticate as the user." BleepingComputer adds that captured hashes can also be cracked offline to recover a password. Similar flaws have been used in phishing campaigns before.

A few details from the advisory put the risk in proportion:

• You have to open the file. Microsoft says the Preview Pane is not an attack vector. Just seeing the email in your inbox doesn't trigger it.
• It's rated Moderate (CVSS 6.5). That label understates it, because it's being used in real attacks and needs only one click.
• Affected products: Microsoft 365 Apps and Office LTSC 2021 and 2024 on Windows, per the advisory's product list. Outlook for Mac, the new Outlook for Windows, Outlook on the web and the mobile apps aren't listed.
• Who found it: Microsoft credits a researcher called "nono" and Benoît Sevens, "using Claude with Anthropic," per the advisory.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10. Federal agencies have until Nov. 24 to patch it. Microsoft hasn't said who is behind the attacks or how many people were targeted.

How to update Outlook (this is the step people miss)

Microsoft's fix lives in the Nov. 10 Office security builds, so update Office itself. These steps come from Microsoft's support page:

1. Open any Office app, such as Word or Outlook.
2. Go to File > Account. In classic Outlook it's File > Office Account.
3. Under Product Information, choose Update Options > Update Now. If you only see "Enable Updates," click that first.
4. Wait for "You're up to date!" or "Updates were installed," then restart Outlook.

How to confirm it worked: Microsoft's release notes list Current Channel Version 2610 (Build 20527.20196) as the Nov. 10 security build. That's the channel most home Microsoft 365 subscriptions, and retail Office 2021 and 2024, use. Office LTSC 2024 needs build 16.0.17932.21140 and LTSC 2021 needs 16.0.14334.21048. To see your build, go to File > Account and look at the About section.

If there's no Update Options button, your Office copy is managed by an employer or school, or it's a volume-licensed install. Microsoft says to contact your help desk. Until the update is in, don't open message files or attachments you weren't expecting, even from someone you know.

This week's update checklist, in priority order

Patch week landed on top of several other urgent updates. If you only have 10 minutes, do them in this order:

1. Outlook / Microsoft 365 on Windows: the steps above. This is the one Microsoft says is being exploited.
2. Chrome, Edge and other Chromium browsers: Google says an exploit exists for CVE-2026-125350, fixed in Chrome 157.0.8103.50. CISA has added it to its exploited list too. We covered it in our Chrome zero-day story, and here's how to update Chrome on any device. Updating Chrome means relaunching the browser.
3. iPhone, iPad and Mac: Apple's Monday updates (iOS 27.2.1, plus 26.7.3 and 18.7.12 for older devices) fix iMessage group chat and Bluetooth pairing bugs. Details are in our iOS 27.2.1 explainer.
4. Windows itself: go to Start > Settings > Windows Update > Check for updates. On Windows 11 25H2 and 26H2, November's update is KB5132061 (builds 26200.9974 and 26300.9974). Run winver to check your build.
5. Android: look for a security patch level of Nov. 5, 2026 or later. See our Android November update story.

Two Windows details worth knowing

• Still on Windows 11 24H2 Home or Pro? Microsoft's release information page lists 24H2 Home and Pro as past end of updates. KB5132061 applies to 24H2 only for Enterprise and Education. If winver shows a 26100 build on a home PC, check Windows Update for the move to 25H2 or 26H2 so you keep getting fixes like this month's.
• NTLM hardening: the same Windows update makes PCs offer NTLM message signing by default for non-anonymous connections. Microsoft says that reduces exposure to NTLM relay attacks. It's a sensible change, but it isn't the Outlook fix. Update Office anyway.

Microsoft also says there will be no optional non-security preview update in late December because of the holidays. The next big update after this is January's Patch Tuesday.

Our take

Don't let the "Moderate" rating fool you. Bugs that leak credentials through a single opened file are popular with phishers, and Microsoft has confirmed this one is being used. Our verdict for anyone running Outlook on a Windows PC: update now, not at the weekend. The step that actually protects you is the Office update. Many people assume Patch Tuesday means Windows Update, see "You're up to date" and stop there.

If you use Outlook on a Mac, the web or your phone, Microsoft's advisory doesn't list your version. Your priorities this week are Chrome and your Apple or Android updates. Household tech helpers have one quick job: check that Office on the family PC can actually update. A greyed-out Update Options button on a personal computer usually means updates were turned off at some point.

Skimwire didn't test exploits. This article is based on Microsoft's advisory and release notes, CISA's catalog and the reporting linked below.

Sources: Microsoft Security Update Guide, CVE-2026-124194 (advisory text and product list read via Microsoft's update API, Nov. 11, 2026); Microsoft 365 Apps security update release notes; Microsoft Support: update Office for Windows; KB5132061; Windows 11 release information; CISA KEV catalog; Chrome Releases; Krebs on Security; BleepingComputer; SecurityWeek.