NexusSec.Microsoft's November release fixed more than a thousand flaws, by Splashtop's count. Only one was already being used in attacks, and it is in Outlook. This post reflects what was published up to 12 November 2026.
What happened
On 10 November 2026, Microsoft fixed CVE-2026-124194 and marked it "Exploitation Detected". CISA added it to its Known Exploited Vulnerabilities catalogue the same day and gave US federal agencies until 24 November to fix it. Microsoft has not said who is behind the attacks or how widespread they are.
Microsoft rates the flaw only Moderate (CVSS 6.5). The user has to open a file, and the flaw leaks information rather than running code. Do not let the rating put it at the bottom of the list: a leaked login hash is often the first step to something worse.
How the attack works
The attacker sends a specially crafted message file and persuades someone to open it in Outlook. Outlook then connects to a network location the attacker controls, without the warning it normally shows before fetching outside content. That connection exposes the user's NTLMv2 hash, which Microsoft says could let the attacker authenticate as that user.
Viewing the message in the Reading Pane does not trigger it; the file has to be opened. A stolen NTLM hash can be relayed to log in to other systems, or cracked offline to recover a weak password, which is why long, unique passwords matter here.
Which versions need the fix
- Microsoft 365 Apps for Enterprise: the November 2026 security update for your update channel.
- Office LTSC 2021: build 16.0.14334.21048 or later.
- Office LTSC 2024: build 16.0.17932.21140 or later.
The fix is not part of the Windows cumulative update. A PC can show Windows as fully up to date while Outlook is still vulnerable. These builds come from reporting on Microsoft's advisory, so check the advisory for your exact version. Office 2016 and Office 2019 left support in October 2025 and no longer get fixes; if you still run them, this is another reason to move.
What to do
Today
- Update Office on every PC, then check it took. In classic Outlook, File, then Office Account, then About Outlook shows the build. If you manage devices centrally, check the update channel status there rather than assuming.
- Block outbound SMB (TCP port 445) to the internet at your firewall. Microsoft recommends it, and almost no business needs SMB leaving the network. It adds a layer; it does not replace the update.
- Warn staff. An unexpected email file sent as an attachment, especially with a push to open it now, deserves a phone call to the sender first.
This month
- Check your firewall logs for outbound connections on port 445 in recent weeks. If a user's PC tried to reach an outside address, treat that user's password as exposed and reset it.
- Install the rest of November's Office updates. The same update also fixes three critical Outlook flaws that could let attackers run code: CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309. None is marked exploited yet.
- Update Chrome and Edge as well. CISA also added a Chromium zero-day, CVE-2026-125350, to its exploited list on 10 November.
- Make a cracked password less useful. MFA on email and remote access means a recovered password is not enough on its own; see where to switch MFA on first.
If updates keep slipping, our post on a patching routine that actually happens is the place to start, and our Microsoft 365 security baseline covers the settings worth checking while you are in there.
Sources
- Microsoft Security Response Center: CVE-2026-124194, 10 November 2026
- Cyber Security News: Microsoft confirms hackers are exploiting Outlook 0-day, 11 November 2026
- Splashtop: November 2026 Patch Tuesday, 10 November 2026
