Imagine receiving an email attachment, opening it in Outlook, and unknowingly allowing your Windows authentication information to reach a server controlled by hackers.
No suspicious software installation. No executable file to launch. Not even the usual security warning that might make you think twice.
Sounds unlikely? Unfortunately, that’s the scenario behind a Microsoft Outlook vulnerability that attackers are already exploiting.
Tracked as CVE-2026-124194, the security flaw was patched on November 10, 2026, and affects certain versions of Microsoft Outlook.
Although Microsoft assigned it a Moderate severity rating, there’s one detail that makes it particularly concerning: the company has confirmed exploitation in real attacks.
How Does the Outlook Vulnerability Work?
The problem involves how Outlook handles specially crafted email message files.
An attacker can send a malicious file and convince someone to open it using a vulnerable version of Outlook.
When the file is opened, Outlook may establish a connection to a network location controlled by the attacker without displaying its usual external content warning. And that’s where things get interesting.
This connection can expose authentication information associated with the user’s Windows account.
The vulnerability does not directly allow attackers to execute malicious programs on the computer. Instead, its primary risk involves leaking authentication data that could support additional attacks. There’s another important distinction.
Simply previewing an email in Outlook’s Preview Pane is not enough to exploit this vulnerability, according to Microsoft’s documentation. The attack requires the victim to open the malicious file and have network connectivity.
What Information Can Hackers Steal?
According to Microsoft, successful exploitation can expose an NTLMv2 authentication hash. Now, that doesn’t necessarily mean attackers receive your password in plain text.
A hash is a calculated value used within security and authentication mechanisms. However, depending on the protections implemented by the receiving systems, attackers may be able to misuse captured authentication information to impersonate users or attempt further attacks.
In other words, the danger isn’t limited to opening the file. It’s what attackers might be able to do afterward.
Microsoft rates the vulnerability’s confidentiality impact as High, while reporting no direct impact on system integrity or availability.
Which Outlook Versions Are Affected?
The affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, covering both 32-bit and 64-bit editions.
For Office LTSC 2021, Microsoft identifies 16.0.14334.21048 as the fixed build. For Office LTSC 2024, the fixed build is 16.0.17932.21140.
Microsoft 365 Apps for Enterprise requires the appropriate November 2026 security update for the organization’s deployed update channel. Businesses should verify that the applicable security updates have been successfully installed.
How Can You Protect Yourself?
The most important step is to install the latest applicable Microsoft Office and Outlook security updates.
Users should also be cautious when opening unexpected email message files, particularly when the sender creates a sense of urgency.
For corporate environments, Microsoft additionally recommends restricting unnecessary outbound SMB connections to the internet, particularly over TCP port 445.
This can help reduce exposure to authentication leaks, but it does not replace the security patch.
IT administrators should verify installed Office versions and follow Microsoft’s official security guidance.
What Does This Incident Teach Us?
This vulnerability is another reminder that cyberattacks don’t always require traditional viruses or suspicious software downloads.
Sometimes, attackers simply exploit how legitimate applications behave during everyday activities. And opening files received by email is something millions of people do routinely.
The difference between a normal workday and a security incident could be a missing software update.
Microsoft has already released a fix. The priority now is making sure it actually reaches affected computers.
Because releasing a security patch is one thing. Making sure everyone is protected is another story entirely.
