Classic Outlook Flaw Being Exploited: Update Office Now (CVE-2026-124194)

At a glance (as of 11 November 2026)

CVE-2026-124194 affects classic Outlook for Windows, the long-standing desktop Outlook that ships with Microsoft 365 Apps and Office LTSC. Microsoft describes it as a flaw where the Outlook user interface does not warn people about an unsafe action, allowing an unauthorised attacker to perform spoofing over a network. CISA lists it as 'Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability' and added it to the Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. KEV entries are CISA's signal that exploitation has been observed.

Public technical reporting says the trigger is a user opening a specially crafted message file in classic Outlook. Outlook then connects to an attacker-controlled network location without the usual warning, and Windows offers the user's NTLM sign-in response to it. The sources we checked do not name the exact file type, so we do not either.

Immediate action: confirm which machines run classic Outlook, deploy the November 2026 Office update to them and check the installed build against the table below. Microsoft has not published a workaround that replaces the update, so patching is the fix.

Who needs to act

The CVE record, published by Microsoft and mirrored by the US National Vulnerability Database, lists three affected products. Each is affected on both 32-bit and 64-bit installs.

• Microsoft 365 Apps for Enterprise: affected until updated to the November 2026 build for your update channel (table in the next section).
• Office LTSC 2021: affected before build 16.0.14334.21048.
• Office LTSC 2024: affected before build 16.0.17932.21140.
• The new Outlook for Windows is reported as not applicable, and Outlook on the web, Mac and mobile are not on Microsoft's list. Check this against the Microsoft Security Update Guide entry before excluding anyone.
• Office 2016 and 2019 are not on Microsoft's affected list and no fix has been announced for them. One trade publication suggests they probably share the weakness. That is an inference, not a Microsoft statement, so if either is still in use, plan to move those users to a supported version and tighten the controls below in the meantime.

Update classic Outlook and confirm the fixed build

Microsoft's Office release notes list this CVE in the 10 November 2026 releases. For Microsoft 365 Apps, the fixed build depends on which channel a machine follows. Any build at or above the figure for its channel includes the fix.

Fixed Microsoft 365 Apps builds: Current Channel 2610 (build 20527.20196). Monthly Enterprise Channel 2610 (20527.20194), 2609 (20430.20264) or 2608 (20326.20320). Semi-Annual Enterprise Channel 2610 (20527.20192), 2609 (20430.20262) or 2608 (20326.20318). For Office LTSC, use the 2021 and 2024 builds in the previous section.

Managed estates should push the update through whatever tooling already controls Office updates, then use that tooling's inventory to find stragglers. The steps below are for checking a single machine or an unmanaged one. Updating closes Outlook and other Office apps, so ask people to save their work first.

1. Open classic Outlook and go to File, then Office Account.
2. Select Update Options, then Update Now. Close Office apps when prompted and let the update finish. Larger updates can take a few minutes; carry on once Outlook reopens.
3. Return to File, then Office Account, and select About Outlook. Compare the version and build with the channel list above. A build at or above the figure for that machine's channel means the fix is installed.
4. If the build is still older, the machine may be pinned to a deferred channel, held back by policy or waiting on a reboot. Check the update channel and any update-deferral settings with whoever manages Office policy.

Understand the real risk

The headline CVSS score is 6.5, Medium. The vector (network attack, low complexity, no privileges, user interaction required, high confidentiality impact only) explains why: nothing runs on the victim's machine and nothing is changed. But the score measures technical severity, not likelihood of attack. CISA's KEV listing and its own exploitation assessment of 'active' say this is being used. The same CISA assessment records that the attack is not automatable, meaning it needs a person to open something.

The practical consequence is credential exposure. NTLM is an older Windows sign-in method. When Windows is tricked into authenticating to an attacker's server, it hands over an NTLMv2 challenge-response. That is not the account's password or its stored NT hash, and it cannot be replayed directly as a pass-the-hash credential. It can, however, be cracked offline if the password is weak, or relayed to another service that accepts NTLM and does not have protections such as signing enabled. A strong password and a hardened environment make both routes harder. Neither is a reason to delay the update.

For a small business, the likely exposure is staff who open emailed attachments from unknown senders. For larger organisations with on-premises NTLM-accepting services, relay is the greater concern.

Reduce exposure while the update rolls out

These are defence-in-depth measures, not Microsoft-endorsed workarounds for this specific CVE. They come from Microsoft's earlier guidance on a different Outlook NTLM-leak vulnerability (CVE-2023-23397) and apply because the end result, NTLM authentication sent to an external server, is the same. Pilot them on a test group first, because blocking NTLM can break legacy applications.

• Block outbound SMB (TCP port 445) from your network to the internet at the perimeter firewall, on local firewalls and in VPN settings. Microsoft's guidance says this stops Windows sending NTLM messages to remote file shares. Check that remote users on split-tunnel VPNs are covered too.
• Consider adding high-value accounts, such as administrators, to the Protected Users group, which prevents NTLM being used for those accounts. Microsoft notes this can break applications that depend on NTLM.
• Enable NTLM auditing, then restrict or deny outbound NTLM where nothing legitimate needs it. Audit first so you find the dependencies before they find you.
• Treat unexpected message-file attachments from outside the organisation with suspicion and consider blocking them at the mail gateway. Tell staff to report anything odd rather than opening it to see.

If someone may already have opened a suspicious file

Patching stops future exploitation. It does not undo a credential response that was already sent. There is currently no public indicator list for this campaign, so detection relies on behaviour. Ask your IT provider or security team to look for outbound connections from Outlook machines to internet addresses on port 445, unusual NTLM authentication involving external destinations, and sign-in anomalies for a user shortly after they opened an attachment. Microsoft's CVE-2023-23397 investigation guidance gives hunting ideas for Defender users, though a failed SMB connection alone does not prove a credential was leaked.

Our judgement, not a vendor requirement: if a specific person opened a suspect attachment before patching and you see outbound authentication attempts, reset that account's password and review its recent activity. Do the same for any account that could have been relayed to. CISA's catalogue entry records no forensic triage requirement for this CVE under its directive, which fits a vulnerability rated as needing user interaction, but it does not rule out compromise in individual cases.

What is confirmed and what is not

Confirmed by CISA's KEV catalogue and alert: exploitation evidence exists and CVE-2026-124194 was added on 10 November 2026. CISA's catalogue shows a remediation due date of 24 November 2026 under its directive, which formally applies to US federal civilian agencies; CISA encourages everyone to prioritise KEV entries. Its entry shows known ransomware use as 'Unknown'.

Not established in the sources we checked: who is exploiting it, how many organisations were targeted, how long exploitation has been under way and the exact attachment type. No organisation has been publicly and credibly linked to this vulnerability, so we name none. We will revise this page as Microsoft, CISA or the UK NCSC publish more.