What is the Outlook vulnerability?
CVE-2026-124194 is a spoofing vulnerability in the Windows desktop versions of Microsoft Outlook included with affected Microsoft 365 Apps for Enterprise and Office LTSC installations. A malicious file can cause Outlook to connect to a location controlled by an attacker without showing the normal external-content warning. During that connection, Windows may send NTLMv2 authentication information.
How could someone be targeted?
An attacker can send a specially crafted message or Office file and persuade the recipient to open it in an affected version of Outlook. Simply receiving the email or viewing it in the Preview Pane is not enough for this vulnerability; the user must open the malicious file. That still makes ordinary-looking invoices, shared documents and urgent requests an important risk.
What could an attacker gain?
The exposed information is an NTLMv2 hash rather than the user's readable password. However, an attacker may try to crack it or reuse it in a relay or impersonation attack against systems that accept NTLM authentication. Depending on the environment, this can contribute to unauthorised access, data exposure, movement into other systems and a larger security incident.
Which Microsoft products should be checked?
Microsoft lists affected editions of Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and 2024, including 32-bit and 64-bit installations. Businesses using managed update channels should confirm that the November 2026 Office security updates have been deployed successfully. Unsupported or rarely connected computers deserve extra attention because they may have missed normal updates.
How to update Office on an individual computer
Open an Office application such as Outlook or Word, select File, then Office Account, choose Update Options and select Update Now. Allow the update to finish, close Office applications when prompted and restart the computer. If Update Options is missing or controlled by your organisation, contact the person who manages your Microsoft 365 or device updates rather than changing policies yourself.
What businesses should check
Confirm which computers have desktop Outlook installed, review their Office update status and check that security updates are not paused or failing. Managed businesses should verify deployment through their device-management or monitoring platform instead of assuming automatic updates completed. Staff should also be reminded to verify unexpected attachments through a trusted contact method before opening them.
What to do if a suspicious file was opened
Stop using the affected computer for email or sensitive work, disconnect it from the network if compromise is suspected and contact IT promptly. Preserve the original message and file for investigation rather than forwarding it widely. The response may include checking endpoint alerts, Windows and authentication logs, Microsoft 365 sign-ins, outbound network connections and whether any internal or legacy service still accepts NTLM authentication.
Why changing the password may not be enough
A password change is often sensible after suspected credential exposure, but this vulnerability concerns NTLM authentication material and possible relay activity. An effective response should also review active sessions, sign-in evidence, affected devices and services that accept NTLM. Your IT provider may need to contain the device and verify that no follow-on access occurred.
What happens if the update is ignored?
An unpatched computer remains exposed to a technique Microsoft says has already been used in real attacks. A successful incident could lead to impersonation, access to business systems, confidential-data exposure, disruption and time-consuming incident response. The risk is greater where older systems, remote access or internal services still rely on NTLM.
Longer-term protections
Keep Office and Windows updates centrally monitored, use endpoint detection and response, filter risky email attachments, restrict outbound SMB traffic and reduce unnecessary NTLM use. Multi-factor authentication remains essential for cloud accounts, but it does not replace patching this desktop Outlook vulnerability. Layered controls help when a convincing message reaches a user despite email filtering.
Check Microsoft’s current advisory
Microsoft may revise affected-product and update information as its investigation continues. View the official Microsoft Security Update Guide entry
Did this guide help?
If an Avant IT article helped you solve a problem or better understand your technology, you can make an optional $5 contribution towards creating more practical guides. Help keep us awake and typing by shouting the team a coffee! Every guide is created in-house by our passionate team, often in our own time, to share our knowledge and give back to the community.
Your support is completely optional but always appreciated.Help us build a free guided troubleshooting centre for common email, Wi-Fi, internet, computer and browser problems.
Support the free tools