Did you install this week’s Windows update and assume Outlook came along with it? Probably not. Microsoft’s November 10, 2026 Patch Tuesday included a fix for an Outlook flaw that attackers were already using, and CyberInsider reports that the fix arrives through Office updates, not the Windows cumulative update. Open Outlook, go to File, Office Account, Update Options, then Update Now. Restart Outlook when it finishes.
That’s the whole job for most people. The rest of this page explains what the bug does, so you can judge how urgent it is for you.
What the Outlook bug actually does
Microsoft tracks it as CVE 2026 124194 and calls it an Outlook spoofing vulnerability. I read Microsoft’s own entry on November 11, and it’s short on drama. An attacker sends a specially crafted message file. If you open it in an affected version of Outlook, Outlook reaches out to a network location the attacker controls and skips the usual warning about external content. Along the way it hands over your NTLMv2 hash, which is a kind of password fingerprint the attacker can use to sign in as you.
Two details lower the risk a little. You have to open the file yourself, and Microsoft states plainly that the Preview Pane is not an attack vector. Merely scrolling past a nasty email in your inbox is not the trigger.
Two details raise it. Microsoft marks the bug as exploited, with exploitation detected, and says it was not publicly known before the patch. Real people were hit first.
Why Moderate is a misleading label
Microsoft scores it 6.5 base and 6.2 temporal, severity Moderate. The reason is simple: nothing runs on your PC and nothing is deleted. The damage is confidentiality only. But a stolen hash on a company account can be the first step into a network, and on a personal PC it matters less. I’d patch today either way. The update takes a couple of minutes, and the bug is already being used.
Two updates, two places
| What | Where it comes from | What to do |
|---|---|---|
| Outlook spoofing fix | Office security update (per CyberInsider) | Outlook: File, Office Account, Update Options, Update Now |
| Windows 11 November update, KB5132061 | Windows Update | Settings, Windows Update, Check for updates, restart |
KB5132061 covers Windows 11 24H2, 25H2 and 26H2, with builds 26100.9974, 26200.9974 and 26300.9974. Microsoft’s support page, dated November 10, says it isn’t currently aware of any issues with the update. Its notes also mention NTLM message signing now being on by default for non anonymous connections, which is related territory but a separate change from the Outlook fix.
If you’re still deciding what to do about an older Windows 11 version, our guide to Windows 11 24H2 end of support covers the dates.
How to update Office and check it worked
Save any open work first. In Outlook, choose File, then Office Account. Under Product Information you’ll see Update Options. Pick Update Now and let it finish. Outlook will ask you to close, and Office may restart a couple of its apps.
To confirm, return to File, Office Account and read the version and build line under About Outlook. Compare it with the build Microsoft lists for your channel. I can’t give you that number: the table of fixed builds on Microsoft’s CVE page wouldn’t load for me, and I won’t guess. If you manage a company fleet, your admin portal will show the right build for your update channel.
Who is exposed
If you use the Outlook desktop app that comes with Microsoft 365 or Office on Windows, assume you are. If you only read mail in a browser or on your phone, nothing I read suggests you need this particular patch, though I couldn’t confirm the status of the new Outlook app. Treat that as unknown until Microsoft’s table is readable.
Until you’ve patched
Don’t open message files or Office attachments from people you don’t know, and be wary of ones from people you do if the request is odd. Their account may be the one that was hijacked. IT teams often also block outbound SMB traffic at the firewall to limit hash leaks. That’s general hardening advice, not something Microsoft’s page lists for this bug.
Quick answers
Does the Windows update fix the Outlook bug?
According to CyberInsider’s report, no. The Outlook fix ships through Office security updates. Install the Windows update too, because it carries other November fixes, but do not treat it as the Outlook patch.
Is the Preview Pane a way in?
Microsoft says no. Its CVE page states the Preview Pane is not an attack vector. Someone has to open the malicious file.
What does an NTLMv2 hash let an attacker do?
Microsoft’s page says the attacker could use it to authenticate as you. That is why a Moderate score for a bug that does not run code still matters, especially on a work account.
Does this affect the new Outlook or Outlook on the web?
I could not confirm that. Microsoft’s page names Microsoft Office Outlook, and the product table with affected builds would not load for me. Classic Outlook on Windows is the safe assumption for now.
Was the bug known before the patch?
Microsoft lists it as not publicly disclosed but exploited. Attacks were detected before the fix existed.
How many flaws did Microsoft fix this month?
About 1,090 or a bit more, depending on who counts. CyberInsider reports 1,094. Trackers differ on whether Edge, Azure Linux and republished third party entries are included, so treat any single number as approximate.
Sources
- Microsoft Security Update Guide, Outlook spoofing vulnerability, released November 10, 2026
- Microsoft support, KB5132061 for Windows 11 24H2, 25H2 and 26H2
- CyberInsider, November 2026 Patch Tuesday report, source for the Office versus Windows update split and the 1,094 count
Checked November 11, 2026. Microsoft may revise its entry, and the affected build table was not readable at the time.
