If you read work email in the classic Outlook app on a Windows PC, open File, then Office Account, and run Update Now before you open another attachment. That one update closes a hole attackers are already using.
Written November 13, 2026. Microsoft has not yet said who is behind the attacks, so some details below may change.
On November 10, Microsoft shipped its monthly security release and flagged exactly one bug in it as exploited in the wild: CVE-2026-124194, a spoofing vulnerability in Outlook. CISA added it to its Known Exploited Vulnerabilities catalog the same day. The bug carries a modest score on paper. What it gives an attacker is not modest: a piece of your Windows sign-in that can be used to pretend to be you.
What CVE-2026-124194 does inside Outlook
Outlook normally asks before it reaches out to an outside server on behalf of a message. That prompt is the reason remote pictures stay blank until you click "download". It exists because the act of connecting tells the other side things about you.
CVE-2026-124194 is a case where the prompt never appears. Microsoft's own one-line description, quoted by The Hacker News, is that the "product UI does not warn users of unsafe actions" in Outlook, which "allows an unauthorized attacker to perform spoofing over a network." CISA files it under CWE-356, the category for software that fails to warn before a risky action.
Microsoft's advisory, as quoted by BleepingComputer, lays out the scenario in three parts. An unauthenticated attacker sends "a specially crafted message file". Opening the file "could cause Outlook to connect to an attacker-controlled network location". And that happens "without displaying the usual external-content warning."
Nothing crashes. No program gets installed. From the victim's chair, a message opened and that was all.
Why a silent connection can cost you your Windows login
Windows is helpful to a fault. When a Windows program connects to certain kinds of network location, such as a shared folder, the system may try to sign in automatically using the account you are logged in with. It does not send your password. It sends an NTLMv2 hash, a scrambled proof that you know the password.
BleepingComputer reports that this is what attackers were after with the Outlook bug: the connection goes to a server they control, Windows offers the hash, and they keep it. Microsoft's advisory puts it more carefully, saying exploitation can lead to "disclosure of authentication information that could be used to impersonate the user."
A captured hash is useful in a couple of ways that have been public knowledge for years. It can be attacked offline, where a weak password falls quickly. In some networks it can also be passed along to another system that accepts it as a login. Either way, the attacker ends up acting as the employee, not as an outsider.
Jack Bicer, director of vulnerability research at Action1, summed it up for The Hacker News: "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity."
That is as far as public detail goes, and as far as this article will go. Microsoft has released no technical write-up of the real-world attacks and no indicators of compromise.
What has to happen for the attack to work
Two conditions matter for judging your own risk.
First, somebody has to open the file. Microsoft states that "exploitation requires network connectivity and user interaction." According to SecurityOnline and the email security firm Suped, Microsoft's FAQ also says the Preview Pane is not an attack vector. Having the message sit in your inbox, or glancing at it in the reading pane, does not trigger the bug.
Second, your PC has to be able to reach the attacker's server. On a home connection that is usually true. Many company networks block that kind of outbound traffic at the firewall, which blunts the attack even on unpatched machines.
So this is a one-click bug, not a zero-click one. That difference is why the score is 6.5 and the label is Moderate. It is also why the label undersells it. Getting an office worker to open a message file is not a high bar.
Exposed or not?
Five quick situations. Based on what Microsoft has said so far.
A suspicious email is sitting in your inbox. You saw it in the reading pane but opened nothing. Did the bug fire?
Which Outlook versions are affected by CVE-2026-124194
The affected software is the classic Outlook desktop app on Windows, in both 32-bit and 64-bit builds. Based on the product list in Microsoft's advisory as reported by SecurityOnline and Suped, that covers:
- Microsoft 365 Apps for Enterprise. The fixed build depends on your update channel.
- Office LTSC 2021. Fixed in build 16.0.14334.21048.
- Office LTSC 2024. Fixed in build 16.0.17932.21140.
None of the reports we read list Outlook on the web, the Outlook phone apps or Outlook for Mac as affected. Suped notes that people who use webmail or mobile are exposed only if they also run one of the listed Office installs on a Windows device. Microsoft's Security Update Guide is the final word on the product list, and it is linked in the sources below.
Home users on a personal Microsoft 365 plan are not named in those lists. Running the update takes two minutes and costs nothing, so do it anyway if you use the classic desktop app.
How to update Outlook and check your build
Office usually updates itself in the background, but it applies the update only after the apps restart, and plenty of people leave Outlook open for weeks. Check it by hand.
Update classic Outlook on Windows
About two minutes. Save any drafts first.
In classic Outlook, click File in the top left corner.
If you manage PCs for a company, the fix arrives through your normal Office update process. Match Microsoft 365 Apps to its release channel and LTSC to its edition, then verify the installed build afterwards. Microsoft lists the per-channel builds in its Office security release notes at aka.ms/OfficeSecurityReleases.
Two extra steps are worth an admin's time. SecurityOnline suggests blocking outbound SMB and NTLM traffic to the internet, which stops this whole family of hash-leak tricks at the network edge. And tell staff plainly: do not open unexpected message files, and report any you already opened.
Who is exploiting the Outlook zero-day?
Nobody outside Microsoft knows yet. The Hacker News reports that Microsoft has not attributed the activity to any threat actor and has not said how many targets were hit. It also has not said whether researchers found the bug before or after attackers did.
The credit line is unusual. According to The Hacker News and SecurityOnline, Microsoft thanked a researcher who goes by Nono and Benoît Sevens of Anthropic, working with the company's Claude AI model. An AI-assisted find landing on an actively exploited bug is a sign of where vulnerability research is heading.
CISA's entry sets a November 24, 2026 deadline for US federal civilian agencies to patch. That deadline binds only those agencies. For everyone else it is a decent hint about urgency.
One exploited bug in a month of more than a thousand fixes
CVE-2026-124194 arrived inside one of the largest Patch Tuesdays on record. The exact size depends on who is counting. Krebs on Security puts it at 1,093 Microsoft vulnerabilities, CyberScoop and Qualys cite 1,094 CVEs in Microsoft's release, and BleepingComputer and The Hacker News reach 1,235 and 1,259 by including Edge and other components. Every outlet agrees on the number that matters here: one bug was under attack at release, and it was this one.
Dustin Childs of TrendAI's Zero Day Initiative told CyberScoop that a single exploited bug is encouraging but "does not mean we're seeing less exploitation in the wild." Attackers often build their tools after the patches come out, by studying what changed.
If you want to keep an eye on what is being exploited right now, the live list at cleus.ai/zero-days tracks every entry in CISA's catalog in plain words, and this bug has its own page at CVE-2026-124194.
Common questions about the Outlook CVE-2026-124194 bug
Is my Outlook affected by CVE-2026-124194?
If you use the classic Outlook desktop app on Windows as part of Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 and have not installed the November 10, 2026 update, treat it as affected. Check File, Office Account, About Outlook for your build and compare it with Microsoft's fixed builds.
Can I be hacked just by receiving or previewing the email?
No, according to Microsoft. Exploitation needs user interaction, meaning the crafted message file has to be opened, and Microsoft's FAQ reportedly rules out the Preview Pane as a trigger. A message sitting unread in your inbox does nothing by itself.
What is an NTLMv2 hash, and why do attackers want it?
It is a scrambled proof of your Windows password that your PC sends when it signs in to network resources. It is not the password itself, but an attacker who captures it can try to crack it offline or, in some networks, reuse it to sign in as you.
Is Outlook on Mac, iPhone, Android or the web affected?
The reports covering Microsoft's advisory list only Windows desktop installs: Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Webmail and mobile apps do not appear on those lists. Check Microsoft's Security Update Guide entry if you need a definitive answer for your setup.
Why is an exploited bug only rated Moderate?
The 6.5 CVSS score reflects that the victim must open a file and that the bug leaks sign-in material without directly running code. Scores measure technical severity, not real-world use. Attackers are using this one today, which matters more than the label.
I opened a strange message file last week. What should I do?
Update Office first. Then change the password for the Windows or work account you were signed in with, and tell your IT or security team so they can check sign-in logs. A long, unique password makes a captured hash far harder to crack.
Who discovered CVE-2026-124194?
Microsoft credited a researcher known as Nono and Benoît Sevens of Anthropic, who worked with the Claude AI model, according to The Hacker News and SecurityOnline. Microsoft has not said who is exploiting the bug.
Got a setup this article didn't cover? Cleus is an uncensored AI that can look up the latest on this bug and walk you through checking your own PC.
Sources
- Microsoft Security Update Guide: CVE-2026-124194
- CISA Known Exploited Vulnerabilities catalog
- BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
- The Hacker News: Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug
- CyberScoop: Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
- Krebs on Security: Microsoft Fixes Nearly 1,100 Security Vulnerabilities
- Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
- SecurityOnline: Outlook zero-day CVE-2026-124194
- Suped: Microsoft patches actively exploited Outlook desktop flaw
Ask the question this article didn’t answer.
Ask anything about cve-2026-124194. Cleus opens this article, searches the live web and gives you a straight answer, with sources.
