Microsoft Rated This Outlook Flaw 'Moderate' — It's Already Being Used to Steal Login Hashes
November 12, 2026
Microsoft's November 10 updates include a fix for an Outlook bug the company already knows is being exploited. The flaw, CVE-2026-124194, is a spoofing issue Microsoft rated moderate, with a CVSS score of 6.5. That label undersells the risk for a CPA firm, a clinic, or a law office where Outlook is open all day. As SecurityWeek reported, quoting Microsoft, an attacker can send a specially crafted message file and convince someone to open it. Outlook then connects to a network location the attacker controls without showing its usual warning about external content, and hands over that user's NTLMv2 login hash — credential material that can be used to impersonate them. The Preview Pane is not a path for this attack; the file has to be opened. Microsoft has not said who was targeted or how widely the bug has been used.
On the same day, CISA added the Outlook flaw — along with an already-exploited Chromium browser bug — to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. The catalog gives federal agencies until November 24 to remediate both. That deadline does not legally bind a private practice in Baton Rouge or along the Gulf Coast, but it is a useful yardstick: this is same-week work, not something to park in next month's maintenance window.
The Chromium issue, CVE-2026-125350, is a use-after-free bug in the browser's XML component. A crafted webpage can be enough to run code inside the browser sandbox. Because Google Chrome, Microsoft Edge, and other Chromium-based browsers share that code, they all need the update. Just as important, the browser has to be restarted. These apps often pull fixes in the background and keep running the old, vulnerable code until someone actually closes and reopens them.
There is a second deadline sitting in the same Patch Tuesday. Microsoft confirmed that Windows 11 version 23H2 Enterprise and Education reached end of updates on November 10, 2026. The November security update is the last one those editions will receive. Home and Pro editions of 23H2 already went out of support a year earlier, on November 10, 2025 — which matters for a lot of small and mid-sized offices that run Pro, not Enterprise. Machines left on 23H2 will not get the next round of monthly security fixes. Microsoft recommends moving eligible devices to Windows 11 version 26H2.
None of this requires exotic tools or a dedicated security team to act on. It does require treating an opened email attachment and an un-restarted browser as the kind of ordinary office behavior attackers are counting on.
What to do this week
- Install November's Outlook and Office updates on every workstation — including Microsoft 365 Apps and Office LTSC 2021 and 2024. In Outlook or Word, go to File, then Office Account, and choose Update Now, or confirm with whoever manages your updates that the November Office patches actually landed.
- Update Google Chrome and Microsoft Edge, then restart the browsers so the Chromium fix is actually running, not just downloaded.
- Inventory any Windows 11 23H2 machines, especially Enterprise and Education editions still in use, and any Pro PCs that may have been off support since last November. Put a plan on the calendar to move eligible devices to a supported release such as 26H2.
- Consider blocking outbound SMB and NTLM traffic to the internet. That cuts off the path this Outlook bug uses to leak a hash, even if someone opens a crafted message before every PC is patched.
- Make sure multi-factor authentication covers email and other primary logins, so a stolen or cracked password is not enough by itself to walk in as that user.
If you want a second set of eyes on whether November's Office and browser updates are actually in place, or which of your PCs are still on Windows 11 23H2, Essential Solutions is happy to walk through it with you. No pressure — just a practical check of the machines your people use every day.