Outlook Zero-Day CVE-2026-124194: What It Does and How to Patch (Nov 2026)

Microsoft's November 2026 Patch Tuesday fixed more than a thousand vulnerabilities, but one matters more than the rest: CVE-2026-124194, a flaw in desktop Outlook for Windows that attackers were already exploiting before the patch shipped. It lets an attacker capture your Windows sign-in hash just by getting you to open a booby-trapped message file.

The catch: this fix comes through Office updates, not the Windows update. If you only installed KB5132061, you're still exposed. Here's what the flaw does, who's affected, and exactly how to patch, for home users and IT admins.

Quick answer: CVE-2026-124194 is an actively exploited Outlook spoofing flaw (CVSS 6.5) that can leak your NTLMv2 hash when you open a crafted message file. Update Office now: in Outlook go to File > Office Account > Update Options > Update Now. Fixed builds are 16.0.14334.21048 (Office LTSC 2021) and 16.0.17932.21140 (Office LTSC 2024); Microsoft 365 Apps get the fix on each update channel. Admins should also block outbound SMB (TCP 445) to the internet and audit outgoing NTLM.

Last updated: November 12, 2026.

Table of contents

• What CVE-2026-124194 is
• How the attack works
• Attack and defence flow
• Who is affected
• How to patch Outlook (home and small business)
• How to check you're patched
• For IT admins: patch, harden and hunt
• If you think you were targeted
• FAQ

What CVE-2026-124194 is

Type	Spoofing (the UI fails to warn before an unsafe action, CWE-356)
Product	Desktop Outlook for Windows in Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit)
Severity	CVSS 3.1 score 6.5; Microsoft rates it Moderate/Important
Exploited?	Yes, in the wild before the patch
CISA KEV	Added November 10, 2026; US federal deadline November 24, 2026
Fix	November 2026 Office security updates

Don't be misled by the "Moderate" score. A medium CVSS combined with real-world exploitation is exactly the kind of flaw attackers use first, which is why CISA gave federal agencies just two weeks to patch.

How the attack works

1. The attacker sends you a specially crafted Outlook message file, usually as an attachment or download that looks like a normal email you need to open.
2. You open it in an unpatched desktop Outlook. (Microsoft says simply seeing it in the Preview Pane is not enough; you have to open it.)
3. Outlook connects to a network location controlled by the attacker without showing its usual warning about external content.
4. Windows automatically tries to authenticate to that server and sends your NTLMv2 challenge-response hash.
5. The attacker can try to crack the hash offline to get your password, or relay it to sign in to other services as you.

Your actual password isn't sent in plain text, but weak or reused passwords can be cracked quickly, and relayed hashes can work without cracking at all. That's why this matters most in company networks.

Attack and defence flow

Who is affected

• Affected: classic desktop Outlook for Windows from Microsoft 365 Apps (business and enterprise), Office LTSC 2021 (before build 16.0.14334.21048) and Office LTSC 2024 (before build 16.0.17932.21140), both 32-bit and 64-bit.
• Not confirmed as affected: the new Outlook for Windows, Outlook on the web, Outlook for Mac and mobile apps. Microsoft's advisory focuses on the desktop Office builds above. If you use the web or phone app but also have desktop Office installed on a PC, patch that PC.
• Highest risk: company PCs joined to a domain, where a stolen hash can be relayed to internal servers.

How to patch Outlook (home and small business)

1. Open Outlook (or Word or Excel; they share the same updater).
2. Go to File > Office Account (or File > Account).
3. Click Update Options > Update Now.
4. Let it download, close Office apps when asked, and wait for "You're up to date!".
5. Restart the PC if prompted.

Don't see Update Options? Your Office is managed by your company (ask IT) or was installed via the Microsoft Store (update it from the Store's Library page).

Also install this month's Windows update. If it won't install, see our fix for KB5132061 errors 0x800f0993 and 0x80070306.

How to check you're patched

1. In Outlook, go to File > Office Account > About Outlook.
2. Note the version and build at the top, shown as Version XXXX (Build NNNNN.NNNNN), and whether it's 32-bit or 64-bit.
3. Compare:
   • Office LTSC 2021: build 14334.21048 or higher.
   • Office LTSC 2024: build 17932.21140 or higher.
   • Microsoft 365 Apps: compare with the November 10, 2026 build for your update channel in Microsoft's Office security release notes (aka.ms/OfficeSecurityReleases).

For IT admins: patch, harden and hunt

1. Patch fast

• Push the November Office security update through Intune, Configuration Manager or the Microsoft 365 Apps admin center. Confirm each update channel (Current, Monthly Enterprise, Semi-Annual) has received a fixed build.
• Check for forgotten installs: old LTSC images, VDI/RDS session hosts and shared PCs. Use a device inventory or a quick script to list Office builds.

2. Reduce what a stolen hash is worth

• Block outbound SMB (TCP 445) to the internet at the perimeter firewall and with Windows Firewall rules on endpoints. Few businesses need it.
• Audit outgoing NTLM with the policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers in Audit mode first, then move towards restricting it.
• Put privileged accounts in the Protected Users group, which stops them from using NTLM.
• Enforce SMB signing and LDAP signing/channel binding to make relay attacks harder.
• Require MFA everywhere you can, so a cracked password alone isn't enough. See our list of 25 Conditional Access policies.

3. Hunt for signs of exploitation

• OUTLOOK.EXE making SMB connections to external or unknown IP addresses shortly after a user opened a message file.
• NTLM authentication to internet destinations in the NTLM Operational log (Applications and Services Logs > Microsoft > Windows > NTLM).
• New or unusual sign-ins for affected users from unexpected systems or IP addresses.

With Microsoft Defender for Endpoint, a starting KQL query:

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort
| sort by Timestamp desc

New to KQL? Start with our KQL for beginners guide and 20 Defender XDR hunting queries.

If you think you were targeted

1. Don't open the file again. Report it to IT or your email security team.
2. Change the password for the affected Windows/Microsoft account, especially if it's weak or reused elsewhere.
3. Admins: revoke sessions, review recent sign-ins and look for lateral movement from the user's account.
4. Patch Office on that PC before the user goes back to work.

Clicked something suspicious on your phone or PC as well? Follow our checklist for what to do after clicking a phishing link.

FAQ

Does the Windows update KB5132061 fix CVE-2026-124194?

No. The Outlook flaw is fixed only by the November 2026 Office security updates. Install both the Windows and Office updates.

Can I get infected just by previewing an email?

Microsoft says the Preview Pane is not an attack vector for this flaw; the crafted file has to be opened. Still, update Office: user interaction is easy for attackers to get.

Is the new Outlook for Windows affected?

Microsoft's advisory lists desktop Office builds (Microsoft 365 Apps, LTSC 2021 and LTSC 2024). It doesn't list the new Outlook, Outlook on the web or Outlook for Mac. If you have classic desktop Outlook installed anywhere, patch it.

What is an NTLMv2 hash?

It's a cryptographic response Windows sends to prove who you are without sending your password. Attackers can try to crack it offline or relay it to sign in as you elsewhere.

Is this similar to the 2023 Outlook flaw CVE-2023-23397?

It has the same goal, stealing NTLM hashes through Outlook, but works differently: CVE-2026-124194 needs the user to open a crafted file, while the 2023 flaw could trigger without any click. The defences (patching, blocking outbound SMB, Protected Users) are similar.

I use Outlook only on my phone. Do I need to do anything?

Update the app as usual, but the advisory focuses on desktop Outlook for Windows. If you also have Office on a Windows PC, update it there.

Sources: Microsoft November 2026 security update guidance as reported by CyberInsider, SecurityOnline, SOC Prime and Suped; CISA Known Exploited Vulnerabilities catalog (added November 10, 2026). Checked on November 12, 2026.