How to Patch the Outlook Zero-Day That Leaks Your Login

If you use classic Outlook on Windows, one fix in Microsoft’s November 10 release deserves your attention. Microsoft addressed more than 1,000 security flaws, and the Outlook zero-day, CVE-2026-124194, was the only one attackers were already using. Opening a booby-trapped message file can expose your Windows login hash, so install the Office security update even if you’ve already run Windows Update.

You see, the step that matters is opening the file. Microsoft rules out the Preview Pane as a way to trigger this flaw, and the fix is available for Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Start with the details below, then check which Office edition you have and how it gets updates.

How the Outlook Zero-Day Steals Your Login Hash

You can open a file and see no warning while Outlook makes a connection in the background. That quiet connection is how an attacker can collect information Windows uses to authenticate you. To see why Microsoft calls this a spoofing flaw, start with what Outlook does when the file opens.

What Happens When You Open the Booby-trapped File

The attacker sends you a message file designed to make Outlook reach out to a server they control. Once you open it, Outlook can contact that server without showing the warning you’d normally get about external content. During that connection, Windows can expose your NTLMv2 hash to the attacker.

That hash is data Windows uses to prove your identity during a network sign-in. If the attacker can use the captured data to authenticate as you, another service could treat the connection as yours.

Why a Moderate Score Still Deserves Your Attention

An attacker can try to relay the captured authentication to a service that accepts it without protections such as signing. They can also try to crack it offline to recover your password. As Nightwing’s Nick Carroll put it, “Don’t let the low score fool you.”

Dustin Childs of the Zero Day Initiative put the Outlook fix at the top of his list because Microsoft had already seen the flaw used in attacks. Notebookcheck reported that a security researcher used Anthropic’s Claude to help find the flaw, though accounts differ on who should get credit.

Which Outlook and Office Versions Are at Risk

If you use classic Outlook on Windows, check the full name of your Office edition. The distinction matters most if yours says 2021, since Microsoft lists a fix for the volume-licensed LTSC edition. Match your edition to the table before you compare build numbers. For last month’s round of fixes, see our October 2026 Patch Tuesday roundup.

What About New Outlook, Outlook on the Web and Mac

Microsoft’s affected product list omits new Outlook for Windows, Outlook on the web, and Outlook for Mac. If you also have classic Outlook on a Windows PC, check the Office edition installed there against the table.

Older Office 2016, 2019 and 2021 Retail Copies

• Retail Office 2021. Microsoft stopped supporting the retail edition on October 13, 2026. If that’s the version you bought, upgrade to a supported edition to keep getting security fixes.
• Office LTSC 2021. Microsoft lists a fixed build for this specific vulnerability in the volume-licensed edition. If that’s what you have, check for build 16.0.14334.21048.
• Office 2016 and 2019. Both are past their support dates and absent from the affected product list for this fix. If you still use either edition, upgrade to a supported release.

Do You Have to Open an Email for It to Work

The action that triggers this attack is opening the crafted message file itself. That distinction matters when you’re deciding what to do with an unexpected attachment. Our list of phishing email examples shows the tricks attackers use to get you to open a file.

The attacker needs a network connection and a way to persuade you to open the file. They can attempt it without an account or existing access to your system. For you, the point to pause is when an email asks you to open an attached message file you weren’t expecting.

Even a familiar sender name can make an unexpected attachment easy to open on autopilot. Leave the message file unopened if you weren’t expecting it, especially while you’re waiting for the Office patch.

How to Install the Fix on Your PC

Start with Office, where Microsoft shipped the Outlook patch. You can check for the update from Word, so you can leave Outlook closed while you get started. If Windows Update gets stuck along the way, try these Windows 11 update fixes.

Update Office First

1. Open Word. Start a blank document to get to the app’s File menu.
2. Go to File > Account. If you’re already in classic Outlook, the path starts with File > Office Account.
3. Choose Update Options > Update Now. Look under Product Information. If you see Enable Updates, select it first, then choose Update Now.
4. Let Office finish and reopen your apps. Close the update dialog once Office finishes checking or installing. Then close and reopen your Office apps, including classic Outlook.

If Update Options Is Missing

If About is the only button you see, your Office installation may use a volume license or your organization may manage updates through Group Policy. Microsoft suggests trying Microsoft Update or contacting your help desk. On a work PC, ask the help desk whether the November Office patch has reached your installation.

Then Run Windows Update

Once you’ve updated Office, run Windows Update for the separate November security fixes. KB5132061 applies to all editions of Windows 11 26H2 and 25H2, plus Windows 11 24H2 Enterprise and Education. If KB5132061 already appears in your Windows update history, check your Office build separately to confirm you have the Outlook patch.

How to Confirm You Are Protected

After you reopen your Office apps, check the build number. The “You’re up to date!” message tells you the Office update check has finished, and the build number lets you confirm you have the fix for your edition. Start there, then check Windows separately.

1. Find your Office build. In Word, go to File > Account and look under Product Information. Select About Word to see the full build number. In classic Outlook, use File > Office Account > About Outlook.
2. Compare it with the fixed build. Look for 16.0.17932.21140 on Office LTSC 2024 or 16.0.14334.21048 on Office LTSC 2021. If you use Microsoft 365 Apps for Enterprise, compare your build with the November 10 entry for your update channel in Microsoft’s Office security release notes.
3. Check the Windows update. Run winver to see your Windows version and OS build. Then open Windows Update > Update history and look for KB5132061 if it applies to your edition.

Extra Protection for Small Business Networks

If you manage a small business network, you can limit where Windows sends authentication traffic and make captured credentials harder to reuse. Keep the Office update at the top of your list, then work through these firewall, sign-in, and email checks.

• Block outbound SMB and NetBIOS. Microsoft’s general firewall guidance calls for blocking internet-bound SMB on TCP 445 and NetBIOS on UDP 137 and 138 and TCP 139. If you rely on a service such as Azure Files, limit the exception to the specific IP addresses you need.
• Block NTLM for SMB clients. On Windows 11 24H2 or later and Windows Server 2025 or later, open Group Policy and go to Computer Configuration > Administrative Templates > Network > Lanman Workstation. Open Block NTLM (LM, NTLM, NTLMv2) and select Enabled.
• Review how your services authenticate. For general network protection, SOCRadar recommends enforcing SMB and LDAP signing, enabling Extended Protection for Authentication, and using the Protected Users group for privileged accounts. On PCs with KB5132061, Windows clients offer NTLM message signing by default when the connection uses an identity.
• Give your staff one clear instruction. Ask them to leave unexpected message-file attachments unopened, even when the sender looks familiar. Check how your email gateway handles those attachments while you roll out the patch.

The Other Big Fixes in This Month’s Update

Microsoft counted 1,094 of its own CVEs, or 1,259 if you add the 165 third-party CVEs it republished. Rapid7 reported 1,092, while the 1,093 tally matches the number with severity ratings. BastionZero reported 1,235 and included 142 flaws in Chromium-based Edge. Once you’ve checked Outlook, use the table to see which other fixes apply to the software you run. Your browser needs attention too, so read why you should update to Chrome 157 right away.

What to Do Today

If you’ve already run Windows Update, open Word and check your Office build. If you still need the patch, back up your important files first, then start with Office. Use this checklist to get through the updates and confirm they landed.

• Back up your files. If it’s been a while since your last backup, make a fresh copy before you start.
• Update Office first. Reopen your Office apps after installation and check your build against the one for your edition.
• Update Windows, then your browsers. Check Windows Update history afterward, and give Chrome its own update check if you use it.
• Review your business firewall. If you manage a small business network, block outbound TCP 445 to the internet and limit any exceptions to the endpoints you need.

FAQs