Microsoft patches actively exploited Outlook flaw, update now
Microsoft has patched an actively exploited Outlook vulnerability, tracked as CVE-2026-124194, which could expose user authentication credentials if a malicious message file is opened.
- The CVE-2026-124194 vulnerability in Outlook was actively exploited in the wild before Microsoft issued a fix.
- An attack requires the victim to manually open a spoofed message file.
- Once opened, Outlook can silently connect to an attacker-controlled server without displaying any security warning.
- Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 are affected.
- The patch is included in the November 10 security update, and users should install it immediately.
Table of Contents
Outlook vulnerability under active exploit
Microsoft has issued an urgent advisory regarding vulnerability CVE-2026-124194 in Outlook. This is a spoofing flaw that stems from the interface failing to warn users prior to an unsafe action.
An attacker would send a specially crafted message file. If the user opens it, Outlook can automatically connect to a server controlled by the attacker, all without triggering the usual security warning dialog.
Risks to users
As a result, user credentials may be exposed. According to security analyses, these are NTLMv2 hashes. Threat actors can use them to impersonate victims or move laterally to other machines across the local network.
Microsoft rates this vulnerability as Moderate severity, with a CVSS score of 6.5. However, active in-the-wild exploitation gives this patch far higher urgency than the score suggests. The US CISA has also added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Affected versions and how to update
Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Notably, an attack only succeeds if the user manually opens the malicious file.
The fix is part of the November security updates released on November 10. Individual users can typically update Office via the Account settings within the application. For enterprise systems, you should contact your IT department to deploy the patch.
The issue resides in an Office component rather than core Windows files. As such, standard Windows updates may not necessarily include the Outlook fix.
With flaws that require user interaction to trigger, safe computing habits are just as vital as software patches. Update Office immediately, and avoid opening suspicious message files from unknown senders. Organizations running Office LTSC should specifically check their Office update channels, as standard Windows patches might not be enough.
Source: PCWorld
Reviewed by: Hero Association
