November Patch Tuesday fixes an Outlook zero-day that attackers already exploit
Microsoft's November Patch Tuesday, released on Tuesday, November 10, fixes an Outlook flaw that the company says attackers are already exploiting. The bug, CVE-2026-124194, can hand an attacker a hash of your Windows sign-in credentials, and the fix comes through Office updates rather than Windows Update.
What the Outlook flaw does
Microsoft classifies CVE-2026-124194 as a spoofing vulnerability and rates it Moderate, with a CVSS score of 6.5. According to Microsoft's advisory, an attacker sends a specially crafted message file and convinces the user to open it in Outlook. Opening the file can make Outlook connect to a server the attacker controls without showing its usual warning about external content.
That connection leaks the user's NTLMv2 hash, which Microsoft says an attacker could use to authenticate as that user. The Preview Pane is not an attack vector, so the file has to be opened.
Microsoft marks the flaw as "Exploitation Detected" but hasn't described the attacks. The advisory credits 2 reporters: "nono" and Benoît Sevens, whose credit reads "using Claude with Anthropic."
Which Office versions are affected
Microsoft lists 6 affected products, the 32-bit and 64-bit editions of:
- Microsoft 365 Apps for Enterprise
- Office LTSC 2024
- Office LTSC 2021
The November 10 Office security release brings Current Channel to version 2610, build 20527.20196. Office LTSC 2024 moves to build 17932.21140 and Office LTSC 2021 to build 14334.21048.
The rest of November's updates
Krebs on Security puts the total at nearly 1,100 vulnerabilities. The Outlook bug is the only one Microsoft lists as exploited.
The Windows 11 update is KB5132061, which brings versions 26H2 and 25H2, plus 24H2 Enterprise and Education, to builds 26300.9974, 26200.9974 and 26100.9974. With this update, Windows offers NTLM message signing by default for non-anonymous connections, a change Microsoft says helps reduce exposure to NTLM relay attacks. The update also fixes USB Audio 1.0 devices that stopped working with error code 10 and a bug that blocked adding printers published in Active Directory.
On Windows 10, the update is KB5131096 (builds 19045.7846 and 19044.7846). It covers PCs enrolled in Extended Security Updates and Windows 10 Enterprise LTSC 2021.
November also brings the last update for Windows 11 version 23H2 Enterprise and Education. Microsoft says that update, KB5131087, is the final one for those editions, and they won't get monthly security updates after it.
What it means for you
Update Office first, since that's where the exploited bug lives. To check for the update on Windows, open Word or another Office app, go to File, then Account (Office Account in classic Outlook) and choose Update Options, then Update Now. Until you've updated, don't open message files you weren't expecting.
Then install the Windows update from Settings, Windows Update. Businesses still running Windows 11 23H2 Enterprise or Education should plan their move to a newer version now. Their PCs stop getting security fixes after this month.
A Windows 10 PC gets these fixes only if it's enrolled in Extended Security Updates or runs Enterprise LTSC 2021. Our Windows 10 ESU guide explains how to enroll, and our Windows 11 compatibility guide can tell you whether your PC can upgrade.