Security update — November 12, 2026. Microsoft has confirmed attacks exploiting CVE-2026-124194, an Outlook security vulnerability. A fix was released on November 10, 2026. Business owners should check affected Office installations and confirm the relevant update is installed.
Your next step: update affected desktop Office software through Microsoft’s official update tools. If you opened a suspicious message file or believe an account has been accessed, contact your IT provider promptly; patching and investigating a possible compromise are separate tasks.
What is the Outlook vulnerability?
Microsoft describes a flaw in which opening a specially prepared message file can make Outlook contact an attacker-controlled location without its usual warning. This can expose an NTLMv2 authentication hash, which an attacker may use to impersonate the user. A hash is authentication material, not a readable copy of the password.
The details are in Microsoft’s CVE-2026-124194 security advisory. The advisory confirms exploitation; it does not establish that every Outlook account has been breached.
Which Outlook users should check their updates?
Microsoft’s affected-product list includes Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Check the advisory’s Security Updates table against your exact installation.
The steps below apply to desktop Office on Windows. If you use a different Outlook application, a Mac, or only webmail, ask your administrator which guidance applies. Avoid installing a package intended for another product or update channel.
How to install the Outlook security fix
For a desktop Microsoft 365 or Office installation that you manage yourself:
- Save your work. An Office update may ask you to close Outlook and other Office applications.
- Open Word or Excel and go to File → Account. In classic Outlook, the section may be called Office Account.
- Under Product Information, select Update Options → Update Now. If prompted, enable updates.
- Allow the installation to finish, close applications when requested and restart if instructed.
- Check the installed Office version and build against Microsoft’s security release information for your product and channel.
Microsoft provides official Office update instructions. If Update Options is missing, the installation may be managed by your organisation or use another servicing method. Contact the administrator responsible for updates.
Keep Windows updated as well, but do not assume that a Windows update alone proves Office has received its fix. For a business with several computers, confirm coverage across all affected installations, including laptops used away from the office.
What if you already opened a suspicious file?
Treat possible exposure as an incident to investigate. Do not reopen the file to test it or forward it to colleagues. Record the sender, subject, approximate time and any security warnings, and tell your IT provider what happened.
Ask the responder to establish which device and identity may be involved. An authentication exposure involving a Windows or domain identity needs the appropriate response; changing only a webmail password may leave other issues unresolved.
If a work Microsoft 365 mailbox may also be compromised, an administrator should review:
- Suspicious sign-ins and available audit records.
- Credential resets and revocation of active sessions where appropriate.
- Unexpected inbox rules, external forwarding and mailbox permissions.
- Unauthorised applications or changes to authentication methods.
- Messages sent by the account and potential effects on other users.
Microsoft’s compromised business email response guide describes the administrator workflow. These checks are broader than installing a patch and should be coordinated with the person responsible for the account.
For a personal Outlook.com or Hotmail account, use Microsoft’s personal account recovery guidance. It includes checking the device for malware and securing the account. Use a trusted device for recovery if the original computer may be unsafe.
How to reduce the chance of another email security incident
Make update ownership clear: someone should know which Office versions are installed and whether security updates have completed. Give staff a straightforward way to report unusual messages without embarrassment or pressure to investigate them personally.
Use unique passwords and appropriate multi-factor authentication, and verify unexpected requests through a known contact method. A message that appears to come from a familiar sender can still be suspicious. Be particularly careful with unexpected files, sign-in requests and changes to payment instructions.
Email security also matters to your website. Mailboxes often receive hosting notices and password-reset links. If an email account is compromised, review connected website and hosting access as part of the response. Our website security checklist explains the wider maintenance and access controls to consider.
Common questions about the Outlook security alert
Can this flaw be triggered just by using the Preview Pane?
Microsoft says the Preview Pane is not an attack vector for this particular vulnerability. Its advisory describes an attack requiring the user to open a malicious file.
Does an Outlook outage mean my email was hacked?
No. Connection failures can have several causes. Check Microsoft’s service status and, for business accounts, your organisation’s service-health notices. Investigate actual signs of unauthorised access separately.
Does updating Outlook remove an attacker who already has access?
Do not assume that it does. An update addresses the software flaw; a suspected compromise also needs account, device and access checks. Tell your administrator about any suspicious activity even after the update finishes.
Does multi-factor authentication replace the security update?
No. Updates and authentication controls address different risks. Keep both in place and have your IT provider assess any possible credential exposure.
Need help understanding the next step?
Web Secured supports businesses in Edmonton and across Alberta with website security, hosting and recovery work. If an email incident may affect your website or hosting accounts, contact us or call 780-399-9116. We can help assess the website-related risks and coordinate with your IT provider when Microsoft 365 administrator access is needed.
If your website is also affected, read how we approach WordPress malware removal and hacked website recovery.
Information checked on November 12, 2026. Follow Microsoft’s advisory for subsequent revisions and product-specific updates. Web Secured is independent of Microsoft.