Microsoft Outlook flaw under active exploitation

Microsoft says attackers are actively exploiting an Outlook vulnerability that can expose authentication information when a user opens a specially crafted message file. The company released a security fix on November 10, 2026, and users need the applicable Office update to address the flaw, identified as CVE-2026-124194.

Microsoft says the file can make affected versions of Outlook connect to an attacker-controlled network location without showing the usual warning about external content. That connection could disclose an NTLMv2 authentication hash, which attackers might use to impersonate a user. The hash is not a readable password, and its exposure does not automatically mean an account has been compromised.

The attack requires a person to open the specially crafted file; merely receiving an email does not trigger the vulnerability. Microsoft has not publicly identified the attackers or disclosed the scale of the attacks, and the reports do not establish how many users or organizations have been affected.

The fix was included in Microsoft’s November security updates. Because the Outlook vulnerability requires an Office or Microsoft 365 Apps update, checking Windows Update alone...