Microsoft has fixed an Outlook flaw that attackers were already using before the patch, and it is the one item in November’s Patch Tuesday that you should not leave for later. If you use Outlook from Microsoft 365 Apps for Enterprise or Office LTSC 2021 or 2024, install this month’s Office update.
The bug is tracked as CVE-2026-124194 and is a spoofing flaw. A booby-trapped message file, once opened, quietly sends Outlook to a server the attacker runs, and the usual external-content prompt never appears. That connection can hand over a sign-in hash, the scrambled form of your Windows network password, which an attacker can then try to abuse inside a company network.
The severity label is only Moderate (6.5 on the CVSS scale), yet Microsoft confirms real attacks. It does not say who was targeted, who was behind the attacks or how many people were affected. Outlook’s Preview Pane is not a route for the attack: the person has to open the file, and the computer has to be online. The affected builds are the 32-bit and 64-bit editions of the three products above, and the entry sits in Microsoft’s Security Update Guide.
The rest of the release is huge. Cyber Security News counted 1,093 newly released fixes this month, spread over Windows, Office, server products, Azure and developer tools. Of those, 63 are rated Critical and 1,029 Important, with one Moderate, which is the Outlook flaw. Elevation of privilege bugs make up the largest group at 535, followed by 296 remote code execution flaws.
Among the Critical fixes are bugs in the Windows SMB server driver and the TCP/IP stack, Exchange Server, and the LDAP service. Hyper-V gets eight Critical elevation-of-privilege fixes, which matters most to people running virtual servers. Microsoft Message Queuing has five Critical remote code execution fixes, and Office has Critical fixes in Excel (12), Word (4), Outlook (3) and PowerPoint (1). None of those Outlook or Office Critical bugs is marked as exploited.
Other Outlook bugs, CVE-2026-124227 and CVE-2026-124228, are rated Important and allow code execution, but neither is marked as exploited. Cloud services get patches too, including Azure OpenAI, Azure Managed Grafana and Microsoft Defender.
For home users, the useful advice is the usual one: run Windows Update and let Microsoft 365 apps update themselves, then restart. In a workplace, the Outlook fix deserves priority over the larger number of Critical patches, because it is the only one with confirmed attacks. Check that Office has updated by opening any Office app and choosing Account, then Update Options.
