Outlook Zero-Day CVE-2026-124194: November 2026 Patch Tuesday, What to Patch First

Last updated: 11 November 2026. Sources are listed at the end.

Microsoft released its November 2026 Patch Tuesday updates on 10 November. One bug was already in use by attackers: CVE-2026-124194 in Outlook. A user who opens a crafted message file can make Outlook connect to an attacker’s server without the usual external-content warning, and that connection hands over the user’s NTLMv2 hash. With that hash an attacker can try to log in as the user elsewhere on your network.

Microsoft rates it only Moderate (CVSS 6.5), so it sits below a long list of Critical bugs this month. It is still the one to fix first, because it is the only one being exploited. It is also an Office fix, and the Windows cumulative update does not close it.

Not sure which PCs are still exposed? Emergency exposure check, ₹2,999, 48 hours. Send us up to 5 hosts or product versions and get a written verdict for each, what to patch first and how to verify the fix. Book the check or ask a question first.

The short answer

• Update Outlook on every PC this week: Microsoft 365 Apps, Office LTSC 2024 or Office LTSC 2021. Start with the machines of people who handle outside email and with admin workstations.
• Check the Office build number afterwards. LTSC 2024 must be on 16.0.17932.21140 or later and LTSC 2021 on 16.0.14334.21048 or later; Microsoft 365 Apps builds are listed per channel on Microsoft’s Office security release page.
• Block outbound SMB (TCP 445) to the internet at your firewall, if you haven’t already. That stops the most common way Outlook hash leaks reach an attacker.
• Install the November Windows cumulative update as well. It carries the Critical fixes for Exchange, Active Directory and Schannel.
• Tell staff that a message file (.msg) arriving as an attachment from outside is unusual and should go to IT before anyone opens it.

What CVE-2026-124194 does

Microsoft’s advisory describes it plainly. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.” Outlook then reaches out to a network location the attacker controls and skips the warning it normally shows for external content. The advisory’s FAQ says the bug “discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.”

Three details from the advisory matter for how you respond:

1. The Preview Pane is not an attack vector. The user has to open the file.
2. Microsoft marks it “Exploitation Detected” and has not said who is using it or against whom.
3. It was not publicly disclosed before the patch, so there was no public proof of concept on release day.

An NTLMv2 hash is not the password. Attackers either crack it offline, which works quickly on short or common passwords, or relay it to another server that still accepts NTLM. Either way, a single opened file can turn into a login on your file server, intranet or VPN.

Microsoft credits two finders: a researcher called “nono” and Benoît Sevens, who used Anthropic’s Claude.

Which Outlook versions are affected

Microsoft lists the fix under Microsoft 365 Apps for Enterprise. The Office apps in Microsoft 365 Business plans are the same Click-to-Run apps and update through the same channels, so treat them the same way. Outlook 2016 and Office 2019 are not in the advisory’s product list. Both are out of support, so the absence of a listing is no proof that they are safe.

Check the Office build and update now

We had no Windows machine in our lab for this guide, so the commands below come from Microsoft documentation and have not been run by us. Run them in PowerShell on the PC you want to check.

Show the installed Office version and update channel:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' |
  Select-Object VersionToReport, CDNBaseUrl

VersionToReport should be at or above the fixed build for your channel or LTSC edition. If it is behind, start an update straight away instead of waiting for the background schedule:

& "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user

Outlook has to close for the update to finish, so tell the user before you run it. In Outlook itself the same check is File, Office Account, Update Options, Update Now.

In a larger office, use whatever already pushes Office updates (Intune, Configuration Manager or Group Policy update deadlines). A deadline of a few days is reasonable for an exploited bug.

Reduce the damage of hash leaks

Patching closes this bug. The steps below make the next Outlook or Windows hash leak far less useful to an attacker, and none of them depend on this CVE.

Block outbound SMB at the firewall

Most hash-leak bugs make the PC open an SMB connection to the attacker’s server on TCP port 445. Office PCs rarely need SMB to the internet, so block it at the perimeter firewall. On a single Windows PC without a managed firewall, Microsoft’s New-NetFirewallRule cmdlet can do the same job:

New-NetFirewallRule -DisplayName "Block outbound SMB to internet" `
  -Direction Outbound -Protocol TCP -RemotePort 445 `
  -RemoteAddress Internet -Action Block

Check first whether you use internet-facing SMB on purpose, for example cloud file shares mapped over port 445. Those connections will stop working with this rule.

Keep admin accounts away from NTLM

Members of the Active Directory group “Protected Users” cannot authenticate with NTLM at all, so a leaked hash for those accounts is worthless for relay. Add your domain admin accounts first, test that they can still log in to everything they manage, and only then widen it. Microsoft’s guidance is to test this group with a few accounts before you roll it out, because older services that need NTLM will break for its members.

Two more settings Microsoft documents for NTLM relay: require SMB signing, and turn on Extended Protection for Authentication on Exchange and IIS. The November Windows update also changes NTLM behaviour itself: according to AdminSignal’s summary of the release, NTLM message signing is now offered by default for non-anonymous connections. Test any old app that logs in with NTLM after you patch.

The rest of November’s Patch Tuesday

Counts differ again this month. Tenable counts 1,093 CVEs with 63 rated Critical, AdminSignal reads 1,094 Microsoft CVEs plus 165 republished non-Microsoft ones in Microsoft’s release note, and BleepingComputer’s headline says 1,235. The bugs below matter more than the total.

Microsoft rates all four “Exploitation More Likely”. Outlook also has three Critical remote code execution fixes this month (CVE-2026-111309, CVE-2026-110068 and CVE-2026-110043), none marked as exploited, which is one more reason to get the Office update out quickly.

If you run Exchange on-premises, patch one server first and check Outlook on the web and mail flow before you do the rest. If you still run Exchange 2016 or 2019, our October Patch Tuesday guide explains why those servers no longer get fixes at all.

Windows update numbers

These are the main cumulative updates as listed in AdminSignal’s November summary. Confirm the build on each machine with winver.

November is the last update for Windows 11 23H2 Enterprise and Education. Plan the move to a supported version for those PCs this month.

Signs that someone used the bug

Microsoft has published no indicators of compromise. Your logs can still show the pattern:

• Firewall logs with outbound connections to TCP 445 on internet addresses from user PCs. Blocked attempts count too, because they show something tried.
• If you run Sysmon or an EDR tool, network events where OUTLOOK.EXE connects to an external address on port 445 or over WebDAV.
• Windows logon events (Event ID 4624) that use NTLM from an unusual machine shortly after someone opened an email attachment.

If you find a successful login with a stolen hash, change that user’s password, check what the account touched, and keep the logs. In India, unauthorised access to IT systems has to be reported to CERT-In within six hours of noticing it under the CERT-In Directions of 28 April 2022. Our 48-hour vendor breach plan covers the same first steps.

Free tool: Attackers who steal a mailbox login often send mail in your company’s name next. Check your SPF, DKIM and DMARC with our email security checker.

Related guides

• Microsoft October 2026 Patch Tuesday: Exchange End of Support
• Your Vendor Had a Data Breach: What to Do in the First 48 Hours
• ConnectWise, Storm-0940 and Microsoft 365 Tenant Takeover
• AI Use Policy for Indian Businesses

Sources

• Microsoft Security Update Guide: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 Nov 2026
• Microsoft: Office security release build numbers
• Tenable: Microsoft’s November 2026 Patch Tuesday addresses 1,093 CVEs
• AdminSignal: November 2026 Patch Tuesday, Windows admin priorities
• Cyber Security News: Microsoft November 2026 Patch Tuesday
• SecurityOnline: Outlook zero-day CVE-2026-124194 exploited in the wild
• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
• CERT-In Directions, 28 April 2022

Need help finding unpatched and exposed systems? Our VAPT services find them before attackers do, and the free website safety check grades your site in seconds. Contact us for a quote.