Microsoft patches an Outlook bug that attackers used to steal Windows login hashes

Microsoft's November security update, released on 10 November, fixes a flaw in Outlook that attackers were already exploiting before the patch shipped. A crafted message file makes Outlook quietly connect to a server the attacker controls, and Windows hands over the user's NTLMv2 login hash along the way. Outlook users should install the Office update now. The same release closes 1,093 vulnerabilities in total, according to Tenable, or 1,235 if Microsoft Edge fixes are counted, as BleepingComputer does.

How the Outlook attack works

Microsoft classifies CVE-2026-124194 as a spoofing flaw and rates it Moderate, with a CVSS score of 6.5. An unauthenticated attacker sends a specially crafted message file. When the victim opens it, Outlook connects to a network location controlled by the attacker without showing the usual warning about external content. Windows may then try to sign in to that server automatically and send the user's NTLMv2 hash.

An attacker can try to crack that hash offline to recover the password, or use it to impersonate the user in further attacks. The attack needs the victim to open the file and have a network connection. According to Microsoft, the Preview Pane is not an attack vector, so simply looking at the message list is not enough.

Microsoft confirms the bug was used in real attacks, but it has not said who was behind them, who was targeted or how widely. BleepingComputer notes that similar Outlook flaws have been exploited before, usually through phishing emails with malicious attachments. Tenable reports that the advisory credits a researcher who found the bug with the help of Anthropic's Claude model.

Who needs to update

The affected products are the 32-bit and 64-bit editions of Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise. The fix comes through Office updates. If Windows Update is not set to install updates for other Microsoft products, check Office separately: in Outlook, open File, then Office Account, then Update Options, and choose Update Now.

Organisations have other bugs to prioritise too. Tenable lists critical remote code execution flaws in Active Directory Domain Services and Exchange Server, both rated 8.8 and "Exploitation More Likely", and an unauthenticated remote code execution flaw in Schannel, the Windows component that handles encrypted connections, rated 8.1. A SharePoint Server privilege escalation bug scores 9.9 but is rated only Important.

Why the numbers are so large

The total depends on who is counting. Tenable and Cyber Security News count 1,093 vulnerabilities released on Patch Tuesday. BleepingComputer adds 142 Microsoft Edge entries and reaches 1,235. It leaves out another 108 fixes Microsoft shipped earlier in November, mostly for its Mariner Linux distribution and Edge. Roughly half of the flaws are privilege escalation bugs, which let an attacker who already has a foothold on a computer gain more control.

BleepingComputer describes November's total as record-breaking, but by its own count October was larger, with 1,411 flaws. Either way, monthly releases now run to four digits. Earlier this year they were far smaller: 54 fixes in February and 163 in April, by Tenable's count. BleepingComputer links the jump to Microsoft's use of AI to find and patch vulnerabilities.

For home users, the practical takeaway is simple. Install the Windows and Office updates, and do not open message files or attachments you were not expecting, even when they look like they come from someone you know.