Microsoft Fixes Exploited Outlook Zero-Day: How to Update Now
Microsoft fixed an actively exploited Outlook flaw that can leak login credentials in its November Patch Tuesday release, which patches 1,094 vulnerabilities.
Image: Wikimedia Commons / Coolcaesar
REDMOND, Washington, 13 November 2026 — Microsoft has fixed an actively exploited flaw in Outlook that can hand attackers a user's login credentials, in a November Patch Tuesday release patching 1,094 vulnerabilities. The Outlook flaw, tracked as CVE-2026-124194, is the only one in the release Microsoft says attackers are already using, and the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on 10 November.
The flaw is a spoofing vulnerability in Outlook, rated Moderate with a CVSS score of 6.5. Opening a crafted message file can make Outlook connect to an attacker-controlled server without warning, disclosing the user's NTLMv2 authentication hash. Microsoft says an attacker could then use that hash to authenticate as the user. Viewing a message in the Preview Pane does not trigger the flaw, according to Microsoft's Security Update Guide.
Key Takeaways
- CVE-2026-124194 is an Outlook spoofing flaw, rated Moderate (CVSS 6.5), that Microsoft says is already being exploited.
- Opening a crafted message file can leak a user's NTLMv2 hash; the Preview Pane alone does not trigger it.
- The fix comes through Office's own updater, not Windows Update — the Windows update alone leaves Outlook exposed.
- CISA added the flaw to its exploited-vulnerabilities catalog on 10 November, with a 24 November deadline for US federal agencies.
How to Update Outlook to Fix CVE-2026-124194
The fix does not arrive through Windows Update. Outlook is patched through Office's own update channel, so a computer that reports itself fully up to date in Windows Update can still run the vulnerable Outlook. In Outlook or Word, go to File, then Account, then Update Options, then Update Now, and install the offered update.
The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit editions. The flaw arrived days after a separate Microsoft 365 outage left about 130,000 users unable to reach Outlook, as reported in The Apex Wire's coverage of the outage.
What the Outlook Zero-Day Steals and Why It Matters
Microsoft classifies the flaw under CWE-356, meaning the product fails to warn the user about an unsafe action. The missing warning is the attack: the crafted file directs Outlook to authenticate against an attacker-controlled server, and the NTLMv2 hash it hands over can be used to pose as the victim. One employee opening a single convincing message can give an attacker a foothold in a network.
Microsoft has not published details of the attacks, the attackers, or the scale of exploitation. What is confirmed is that the flaw was not publicly disclosed before the fix shipped, which indicates Microsoft learned of it from real attacks rather than a research paper.
What Else Microsoft Fixed in the November 2026 Patch Tuesday
The November release is one of Microsoft's largest: 1,094 vulnerabilities, with 66 rated Critical, including 20 remote code execution flaws in Outlook alone. Counts run higher when the Chromium-based Edge browser is included, reaching 1,235 in one tally. The Windows 11 update, KB5132061, covers versions 24H2, 25H2 and 26H2, while KB5131087 is the final update for Windows 11 23H2 Enterprise and Education. Microsoft's researchers also published work on hidden backdoors in AI agents, covered in The Apex Wire's report on the findings.
| November Patch Tuesday | Detail |
|---|---|
| Vulnerabilities fixed | 1,094 (1,235 including Edge) |
| Rated Critical | 66 |
| Actively exploited zero-day | 1 — CVE-2026-124194 (Outlook, CVSS 6.5) |
| Outlook remote code execution flaws | 20 |
| Windows 11 update | KB5132061; KB5131087 (23H2) |
| CISA remediation deadline | 24 November 2026 (US federal agencies) |
Frequently Asked Questions
Is the Outlook zero-day CVE-2026-124194 being exploited?
Yes. Microsoft marks the flaw as "Exploitation Detected" in its Security Update Guide, and CISA added it to its Known Exploited Vulnerabilities catalog on 10 November 2026. Microsoft has not published details of the attacks.
Does Windows Update fix the Outlook zero-day?
No. The Outlook fix is delivered through Office's own updater, not Windows Update. In Outlook or Word, go to File, then Account, then Update Options, then Update Now. Installing the Windows update alone leaves Outlook exposed.
When do US federal agencies have to patch CVE-2026-124194?
By 24 November 2026, the deadline CISA set when it added the flaw to its Known Exploited Vulnerabilities catalog. It applies to US federal civilian agencies under CISA's binding operational directive.
US federal agencies must apply the fix by 24 November 2026, and Microsoft's next Patch Tuesday falls on 8 December. Microsoft has not yet published details of the attacks or named the attackers.
