Update Office now: Microsoft fixes an exploited Outlook flaw that leaks login hashes

Microsoft's November 10 updates fix an Outlook flaw that attackers are already using. Opening a booby-trapped file can hand over your Windows sign-in hash.

In this brief: 3 sections 1 min read

- A crafted message file makes Outlook reach out to an attacker's server without the usual external-content warning. That leaks the user's NTLMv2 hash, which reporters say can be cracked offline or relayed to impersonate the user. The victim must open the file; Microsoft says the Preview Pane is not an attack vector.
- Microsoft 365 Apps for Enterprise; Office LTSC 2021 before build 16.0.14334.21048; Office LTSC 2024 before build 16.0.17932.21140. Microsoft has confirmed exploitation, and CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10.
- In Word, Excel or Outlook: File, Account, Update Options, Update Now, then restart Office. Also run Windows Update (Start, Settings, Windows Update, Check for updates); on Windows 11 this month's updates are KB5132061 and KB5131087. Work computers may be updated by your IT team.

Read full analysis on msrc.microsoft.com

Useful?