Outlook CVE-2026-124194: The Office Builds That Fix the NTLM Leak

Published 11 November 2026 · Rathish Kumar, Invitty

Microsoft's 10 November 2026 security release fixes CVE-2026-124194, an Outlook flaw that Microsoft says is already being exploited. If a user opens a crafted message file, Outlook can connect to an attacker's server without the usual external-content warning and hand over the user's NTLMv2 hash. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 are affected. Get every Windows PC that runs desktop Outlook onto the November build this week.

What does CVE-2026-124194 actually do?

Microsoft classes it as a spoofing vulnerability: the Outlook interface fails to warn the user before an unsafe action. In practice an attacker sends an Office or message file, persuades someone to open it, and Outlook quietly reaches out to a network location the attacker controls. That connection carries the user's NTLMv2 hash, and Microsoft's own FAQ says the attacker could use it to authenticate as that user.

The score is 6.5, rated Moderate. Do not let that number set your priority. Microsoft marks the flaw as exploited, it was not publicly disclosed before the fix, and CISA added it to its Known Exploited Vulnerabilities catalogue the same day. A Moderate bug that someone is using today outranks a Critical bug that nobody has touched. Microsoft has not shared details of the attacks or any indicators of compromise.

Two details narrow the risk a little. Microsoft says the Preview Pane cannot be used to trigger it, so simply selecting an email does nothing. And the user has to open the file. Anyone who has run a phishing simulation in an Indian office knows how small that hurdle is.

Which Office versions are affected and which builds fix it?

Microsoft's security update guide lists three products: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office LTSC 2021 and Office LTSC 2024. Its Microsoft 365 Apps release notes for 10 November give these builds. A PC on the listed build or later has the fix.

Office 2019 is not on Microsoft's affected list for this CVE. That is not a reason to relax about it. Office 2019 reached the end of extended support in October 2025, and the next Outlook flaw may not spare it.

How to check a PC and push the update

On any PC, open Outlook and go to File, Office Account, then About Outlook. The version and build appear at the top. Compare them with the table above for that PC's channel. If it is behind, Update Options, then Update Now on the same screen pulls the release.

Click-to-Run installs update themselves, but in our experience the laptops that lag are the ones where Outlook is never closed, along with machines where an administrator set a deferral in Intune, Configuration Manager or Group Policy and then forgot about it. If you manage updates centrally, check whether a deferral is holding November back, and shorten it for this release. For a 30 to 100 seat office without central management, the quickest route is a message asking everyone to close Outlook and restart before lunch, followed by a spot check on a few machines.

Make a leaked hash worth less

Microsoft has published no workaround for CVE-2026-124194, so the update is the fix. Hash-leak bugs in Outlook are not new, though, and the hardening Microsoft gave for the 2023 Outlook flaw CVE-2023-23397 still reduces the value of whatever leaks:

• Block outbound TCP 445 (SMB) at the perimeter firewall, on local Windows firewalls and in VPN settings, so NTLM traffic cannot reach file shares on the internet. On most FortiGate, Sophos and SonicWall setups this is one outbound rule. Our firewall page covers the platforms we manage.
• Put high-value accounts in the Protected Users group, which stops those accounts using NTLM. Microsoft warns this can break applications that still depend on NTLM, so test with domain admin accounts first.

Neither step replaces the patch. Both are worth doing anyway, because they also blunt the next variation of this bug.

What else came in November's Patch Tuesday

This was an unusually large release. SecurityWeek counted 1,094 vulnerabilities fixed, including 9 in Exchange Server, with critical-rated updates for Windows 10 and 11, Windows Server 2016 through 2025, Office and Exchange Server Subscription Edition. It is also the last monthly security update for Windows 11 version 23H2 Enterprise and Education, which we covered in our post on 23H2 reaching end of servicing. If you are scheduling one maintenance window for Office, schedule Windows in the same one.

What this means for Microsoft licensing in India

Organisations on a Microsoft 365 subscription get the fixed Outlook as part of what they already pay for. The harder cases are offices with a mix: a subscription for most staff, plus a few shared PCs still on a perpetual Office 2016 or 2019 licence bought years ago. Those machines receive nothing, and they are usually the reception or accounts desk that opens the most attachments from outsiders.

If that describes you, this is the moment to price the gap. Compare adding Microsoft 365 seats against Office LTSC 2024 volume licences for those PCs, with GST invoices on both, and pick based on how long you plan to keep the machines. Our Microsoft 365 page explains the plans we supply, and if your subscription is near its anniversary the renewals team can align the extra seats with it. If you find signs that a hash was misused, CERT-In's six-hour reporting rule for certain incidents may apply, so involve your incident owner early.

Questions we are hearing about the Outlook zero-day

Next step

Send us a list of the Office versions in use, or an export from the Microsoft 365 admin centre or Intune, and we will tell you which PCs are behind the November build, which ones run unsupported Office, and what it would cost to bring them onto a supported licence.