Microsoft November 2026 updates fix Outlook flaw used in attacks

Microsoft released its November 2026 security updates at midnight on 11 November, Malaysia time. One of the fixes is for Outlook flaw CVE-2026-124194, which Microsoft says attackers are already using. The US agency CISA added it to its list of exploited flaws on 10 November. Please update Windows and Microsoft Office on every office computer this week, then restart.

What is the Outlook flaw?

Microsoft explains it like this. An attacker sends a specially made message file and gets someone to open it in Outlook. When it opens, Outlook may connect to a network location the attacker controls, without the warning it normally shows for outside content. That can give away the user's login information (an NTLMv2 hash), which the attacker could use to sign in as that person.

The file has to be opened for this to work. Microsoft says simply looking at the email in the Preview Pane does not trigger it. Microsoft rates the flaw Moderate, but because it is already being used, it is worth fixing now and not waiting for the next routine update.

Microsoft lists these versions as affected:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Office LTSC 2021, fixed in version 16.0.14334.21048
• Office LTSC 2024, fixed in version 16.0.17932.21140

What else is in this month's update?

This is a very large release, with well over a thousand fixes in Microsoft's own list, including more than 160 for the Chromium code inside Microsoft Edge. Singapore's Cyber Security Agency lists the Critical ones, among them holes in Word, Excel, PowerPoint and Outlook that could let a bad file run code, plus flaws in Windows Search and LDAP. Outlook CVE-2026-124194 is the only one Microsoft marks as already exploited.

What to do

1. Windows: open Settings, then Windows Update, then click Check for updates. Install everything listed and restart when asked.
2. Outlook and Office: open Word or Outlook, go to File, then Office Account (or Account), then Update Options, then Update Now. Close all Office apps if it asks you to.
3. Restart the computer after both updates. Some fixes only take effect after a restart.
4. If someone else looks after your PCs, forward this post to your IT person or vendor today and ask them to confirm every computer is done.
5. Check again in two or three days. Office updates can arrive a little later on some computers, and laptops that were switched off will miss the first round.
6. Remind staff not to open unexpected attachments or message files, even from a known sender, until their PC is updated. If something looks odd, ask before opening.
7. If a staff member opened a strange file in Outlook recently, change that person's password and tell your IT support.

How SyncTech can help

Most bad message files arrive by email. Our anti spam email hosting filters harmful attachments before they reach your staff's inbox.

Source and credit

We are sharing this news from Microsoft, NIST, CISA, the Cyber Security Agency of Singapore and SANS ISC. This summary is written by Synctech in our own words.

• Microsoft Outlook Spoofing Vulnerability CVE-2026-124194, Microsoft Security Response Center, 10 November 2026: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
• November 2026 Security Updates release notes, Microsoft Security Response Center, 10 November 2026: https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov
• CVE-2026-124194 Detail, National Vulnerability Database, NIST, 10 November 2026: https://nvd.nist.gov/vuln/detail/CVE-2026-124194
• Known Exploited Vulnerabilities Catalog, CISA, 10 November 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194
• November 2026 Monthly Patch (AL-2026-160), Cyber Security Agency of Singapore, 11 November 2026: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-160
• Microsoft Patch Tuesday November 2027 (title as published), SANS Internet Storm Center, 10 November 2026: https://isc.sans.edu/diary/rss/33508 Retrieved 11 November 2026. Microsoft, Outlook, Windows, Microsoft 365, Word, Excel, PowerPoint and Microsoft Edge are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.