Microsoft patched an Outlook flaw this week that attackers are already using.
Someone emails you a specially built message file. You open it, and Outlook quietly gives the attacker something they can use to pretend to be you on your company network. Microsoft rates it "Moderate". I don't.
What happened
On November 10, Microsoft put out its monthly batch of security fixes, which the industry calls Patch Tuesday. One of those fixes closes a hole in Outlook, the email program most offices use. It's tracked as CVE-2026-124194. A CVE is just the tracking number the industry gives each security bug, so you and your IT person are talking about the same thing.
Microsoft says the flaw "was exploited in the wild as a zero-day." In plain words, attackers were already using it before any fix existed. Microsoft hasn't said who's behind the attacks or how many people were targeted.
Microsoft calls it a "spoofing" flaw and gives it a severity score of 6.5 out of 10. The US government's cyber agency (CISA) added it to its list of flaws known to be used in real attacks on November 10 and told US federal agencies to patch by November 24.
What this means in plain English
When you open the booby-trapped message file, Outlook reaches out to a computer the attacker controls. Normally Outlook would stop and warn you about outside content first. With this flaw, it skips that warning.
Windows then does something it was built to do on office networks. It introduces itself to that computer by sending a scrambled copy of your Windows login. Think of a receptionist who reads your building pass number to any stranger who phones and asks politely.
The attacker can use that scrambled login to sign in to other systems as you. They don't need your actual password.
The good news: just looking at the email in the preview pane isn't enough. You have to open the file. The bad news: it only takes one person opening one file.
Why a small business should care
Most small offices run on Outlook and Microsoft 365. A stolen login is a foothold. From there an attacker can try your shared drives, your accounting system and anything else that trusts that person's Windows account.
The fix is already out. The only thing standing between you and this attack is whether the update actually got installed on every computer.
Who's affected
Microsoft lists these as affected:
Microsoft 365 Apps for Enterprise (the installed Office apps that come with Microsoft 365 subscriptions)
Office LTSC 2021, before build 16.0.14334.21048
Office LTSC 2024, before build 16.0.17932.21140
Office 2016 and 2019 aren't on the list. That's not good news. They stopped getting security updates in October 2025, so if you're still on them, you're exposed to plenty of other problems.
What to do: everyone
Open Outlook, click File, then Office Account, then Update Options, then Update Now.
Close and reopen Outlook when it's done.
Don't open attachments that are themselves email messages unless you were expecting them, even from a name you know.
If Outlook does something odd after you open an attachment, tell whoever looks after your IT. Don't wait to see if it happens again.
What to do: if you run the business
Get confirmation that every computer has the November Office updates installed, not just "set to update."
If anyone is still on Office 2016 or 2019, budget to replace it now.
Remind staff, in one short email, not to open unexpected attached messages.
Don't let the "Moderate" label set your priority. Microsoft's own advisory says this one is being used in real attacks.
Questions to ask your IT provider
Can you show me that every computer has the November 2026 Office security update?
Are any of our machines still on Office 2016 or 2019?
Is our network set up to stop computers sending Windows logins out to the internet?
Would we notice if someone used a staff member's login from somewhere unusual?
Sources
Tenable: Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)
Notebookcheck: Exploited Outlook zero-day was found by a researcher using Claude
Daily CyberSecurity: Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch
Contact Nautalex to see how we can help you with Outlook and Microsoft 365 security.
