Microsoft is warning Outlook users to update immediately after hackers began exploiting a vulnerability that can expose information used to verify their identity. The flaw, tracked as CVE-2026-124194, can trigger a connection to a server controlled by attackers when someone opens a specially crafted Outlook message file. Worse, Outlook may do this without displaying its usual warning about potentially unsafe external content.
That connection could expose an NTLMv2 hash, a piece of authentication data criminals may be able to abuse to impersonate a victim and potentially access workplace systems or other accounts.
Microsoft has already released a fix, but your computer isn’t necessarily protected just because Windows Update says everything is current. So you want to read to the end.
The Outlook bug doesn’t need your password to cause trouble
NTLMv2 hashes aren’t actual passwords. They are part of an authentication process Windows uses to verify someone’s identity when connecting to certain services. But criminals can potentially abuse stolen authentication data to impersonate a legitimate user. That means an attacker does not necessarily need to trick you into typing your password into a fake login page. A malicious message file could initiate the connection that exposes information used in authentication.
However, simply receiving an ordinary email isn’t enough to trigger the attack. The vulnerability requires someone to open a specially crafted message file in an affected version of Outlook. Still, that’s not exactly a comforting requirement when malicious attachments can be disguised as invoices, documents, work requests or messages from familiar contacts.
Updating Windows alone won’t fix this problem
Microsoft released a patch for the vulnerability as part of its November 10 security updates. The catch is that the relevant fix is delivered through Office, so checking Windows Update alone is not enough to confirm you have installed it.
Fortunately, checking for the update is relatively painless. Open an Office application such as Word, then select File > Account > Update Options > Update Now. If you are using classic Outlook, the menu may instead say Office Account.
If you see an Enable Updates option, select it before checking for updates. Microsoft may ask you to close Office applications or restart your computer to complete the installation, so save anything you are working on first.
If you are using a company computer and the update controls are missing or disabled, your employer’s IT department may manage Office updates. Contact the help desk to confirm the security patch has been deployed.
A Microsoft security cleanup
The Outlook vulnerability wasn’t the only security headache in Microsoft’s November update package. The company addressed more than 1,000 vulnerabilities across its products, including other weaknesses that could potentially allow attackers to execute malicious code.
That doesn’t mean every Microsoft user is facing the same threat. Different vulnerabilities affect different products and configurations, and the Outlook flaw specifically involves opening a specially crafted message file.
What Outlook users should do right now
Install the latest Office security updates, and don’t assume your work computer has already received them without checking. Until the patch is installed, avoid opening unexpected message files or attachments, even if they appear to come from someone you know. If something looks suspicious, verify it with the sender through another trusted channel before opening it.
The vulnerability does not automatically mean hackers can access every Outlook account, and installing the update closes this particular security weakness. But with active exploitation already confirmed, you don’t want to wait around for a more convenient time to update. Your inbox might be full of spam, questionable newsletters and emails you meant to read and reply three weeks ago. The last thing it needs is to become an unexpected entry point for cybercriminals.
Sources: Daily Mail, PCWorld