In short: CVE-2026-124194 is a flaw in the Outlook app for Windows that Microsoft lists as exploited. The fix arrives through the normal Microsoft 365 Apps and Office update. Update Office on every Windows computer, restart Outlook, and treat unexpected attachments with care. A vulnerability is a weakness in software that attackers can use to break in or steal data.

CVE-2026-124194 at a glance

What

A flaw in the Outlook app for Windows. Microsoft lists it as exploited.

Who

Every Windows computer with the Outlook app from Microsoft 365 Apps or Office.

Fix

Install the November 2026 Office update, then restart Outlook.

Source: Microsoft Security Response Center and the CISA Known Exploited Vulnerabilities catalog, checked November 12, 2026. Hexafusion IT Solutions.

What happened

On November 10, 2026, Microsoft published CVE-2026-124194, which it titles "Microsoft Outlook Spoofing Vulnerability". Microsoft describes it as a case where Outlook does not warn the user before an unsafe action, rates it Moderate with a score of 6.5 out of 10, and marks it as exploited. An attack needs the user to take a step, such as opening a file.

The same day, the Cybersecurity and Infrastructure Security Agency (CISA), the United States cyber defence agency, added it to its Known Exploited Vulnerabilities catalog and gave United States federal agencies until November 24, 2026 to act.

What an attacker gains

Security researchers report that opening a specially prepared message file makes Outlook connect to a server the attacker controls, without the usual warning. That connection can hand over a scrambled form of the user's Windows password. Attackers can try to crack it or reuse it to sign in to other systems as that person.

A Moderate rating does not mean low priority here. Attackers are using the flaw now, and a stolen sign-in is often the first step of a larger break-in.

Who is affected

  • Windows computers with the Outlook app installed as part of Microsoft 365 Apps or Office.
  • The fix is delivered through the Microsoft 365 Apps and Office updates, so each of those computers needs the November 2026 update.

What to do now

  1. Update Office. In Outlook or Word, open File, then Office Account, then Update Options, and choose Update Now. In a managed environment, your IT team sends the update to every computer.
  2. Restart Outlook when the update asks, so the fix takes effect.
  3. Be careful with unexpected attachments, especially forwarded email files, even from people you know.
  4. Keep the second step at sign-in turned on. Multi-factor authentication (MFA) means a stolen password alone does not open an account.
  5. Ask your IT team two questions: have all computers received the November Office update, and are outgoing file-sharing connections to the internet blocked at the firewall? The second measure limits what this kind of flaw can leak.
Hexafusion clients: we are installing Microsoft's November security updates on managed computers this week. Please restart your computer when it asks.

This flaw is separate from the Microsoft 365 outage of November 12, 2026. For the other security steps every organization should have in place, see our security protections checklist and what to do if someone clicked a phishing link. We also explain multi-factor authentication.

Sources

Common questions

What is CVE-2026-124194?
A flaw in the Outlook app for Windows, published by Microsoft on November 10, 2026. Microsoft rates it Moderate, with a score of 6.5 out of 10, and lists it as exploited.
How do I fix it?
Install the November 2026 update for Microsoft 365 Apps or Office. In Outlook or Word, open File, then Office Account, then Update Options, and choose Update Now. Then restart Outlook.
Is Outlook safe to use?
Yes, once the November 2026 Office update is installed. Until then, be careful with unexpected attachments, especially forwarded email files.
Is this related to the Microsoft 365 outage of November 12, 2026?
No. The outage was a service problem at Microsoft. CVE-2026-124194 is a security flaw in the Outlook app that is fixed by an Office update.

Not sure whether every computer is updated?

We check and update Microsoft 365 Apps on every managed computer, and confirm it in writing.

Talk to us