TL;DR
- Microsoft released a fix on November 10 for an Outlook flaw that attackers are already using.
- Opening a crafted message file can leak the user's NTLMv2 login hash.
- The November Office updates cover Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
- CISA gave federal agencies until November 24, and private businesses shouldn't wait that long.
- In Outlook, go to File, then Account or Office Account, then Update Now.
Microsoft released a fix on November 10 for an Outlook flaw that attackers are already using. The flaw is tracked as CVE-2026-124194. Microsoft classifies it as a moderate spoofing issue with a CVSS 3.1 base score of 6.5.
An attacker sends a crafted message file that the user must open in affected Outlook. Opening the file can make Outlook connect to an attacker-controlled location without the usual external-content warning. That connection can disclose the user’s NTLMv2 login hash, a form of the user’s Windows sign-in credentials. Microsoft says the attacker could use that hash to authenticate as the user.
The Preview Pane is not an attack vector. The recipient has to open the file. That is not a reason to wait on the update. Microsoft has already published the November Office security updates covering Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
The fix is straightforward on a PC that updates itself. Open Outlook. Go to File, then Account or Office Account. Under Product Information, choose Update Options, then Update Now. Restart Outlook after the update finishes. If those controls are missing, updates may be managed centrally. Ask the person who handles your Microsoft 365 environment to confirm that the November 10 Office updates are installed.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10. Federal agencies have until November 24 to remediate it. That deadline does not bind a private business in Athens. It remains a useful marker. The patch is already available. There is no reason to leave Outlook unpatched until the end of the month.
Staff can help while the update rolls out. Treat unexpected message files with care. Do not open an Outlook file from a stranger just to see what it is. The same rule applies to a surprising file from a familiar name. Report suspicious mail in Microsoft 365 with the Report phishing action. The patch remains the real fix.
Athens businesses can ask Microsoft-certified, veteran-owned My I.T. Consultants for a Free Assessment of Microsoft 365 and Outlook updates. Call 903-675-5431 Monday through Friday from 7:00 a.m. to 6:00 p.m.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
