Microsoft has fixed an actively exploited zero-day flaw in Outlook as part of its November 2026 Patch Tuesday, released on 10 November. The update fixes 1,094 vulnerabilities in total, 63 of them rated critical, but the Outlook flaw is the most urgent because attackers are already using it.

How the Outlook flaw works

The flaw, tracked as CVE-2026-124194, is a spoofing vulnerability rated moderate with a CVSS score of 6.5. If a user opens a specially crafted message file, Outlook can connect to an attacker-controlled network location without showing its usual warning about external content. That connection discloses the user's NTLMv2 password hash, which an attacker may relay to sign in as the user or try to crack to recover the password. The Preview Pane is not an attack vector.

Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 are affected. Microsoft credits a researcher using the name "nono" and Benoît Sevens with reporting the flaw. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalogue on 10 November, with a fix deadline of 24 November for federal civilian agencies.

Other critical fixes in the release

The same update also fixes a Windows LDAP remote code execution flaw, CVE-2026-119958, rated 9.8, which puts domain controllers and Active Directory at risk, and a Microsoft Exchange Server remote code execution flaw, CVE-2026-118207, that can be triggered by anyone able to send email to an organisation. Administrators should apply the November updates now, starting with Outlook and the critical remote code execution fixes.