Microsoft released a security update on Thursday fixing an actively exploited Outlook vulnerability tracked as CVE-2026-124194.
The flaw allows attackers to trick users into opening a manipulated message file that forces Outlook to connect to an unauthorized network location. According to Infobae, the connection occurs without displaying the usual external content warnings, exposing the user’s NTLMv2 hash to attackers.
That cryptographic hash can be cracked offline or used directly to impersonate the victim across Windows systems, as SoftZone reported. The software giant issued the fix as part of its monthly security update cycle, which addresses more than 1,200 vulnerabilities across various products.
“Don’t let the low score fool you,” said Nick Carroll, incident response manager at Nightwing, urging organizations to apply the patch immediately during an interview with CSO Online. Microsoft rated the vulnerability as moderate with a CVSS score of 6.5 out of 10, noting that exploitation requires a network connection and user interaction through opening the file.
The security update applies to Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. TechRepublic warned that installing standard Windows operating system updates does not automatically resolve the issue, as administrators must specifically deploy the Office or Microsoft 365 application patches.
The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its known exploited vulnerabilities catalog on November 10. CISA set a deadline of November 24 for federal civilian agencies to secure their systems against the bug.
The disclosure coincided with a separate technical disruption on November 12 that caused widespread login problems for Microsoft 365, Teams, and Outlook users worldwide. Revista Semana reported that Downdetector registered roughly 130,000 incident reports for Outlook during the peak of the outage, though investigators found no evidence linking the service disruption to the zero-day vulnerability.
Microsoft credited the discovery of the Outlook flaw to an independent researcher named Nono and to Benoît Sevens of Anthropic, who utilized Claude to analyze system code.
The November update bundle corrects approximately 1,235 total issues, with Windows components accounting for the majority of the patches.
