Outlook File-Opening Flaw: Check Your Office Update
Use Outlook on a Windows work PC? Ask IT to confirm the November Office security update, and verify unexpected message files before opening them. Microsoft says attackers are exploiting a flaw that can expose authentication information.
The short version
What you need to know
- The attacker must persuade someone to open a malicious file in an affected Outlook version. Microsoft explicitly excludes the Preview Pane as an attack vector.
- The advisory lists Microsoft 365 Apps for Enterprise and Office LTSC 2024 and 2021, in 32-bit and 64-bit editions. Match the update to your installed product.
- A Windows update check alone is not confirmation that Office received this fix. On managed PCs, ask the help desk to verify the Office deployment.
What can happen when the file opens
Microsoft's 10 November advisory marks CVE-2026-124194 as exploited. A specially crafted message file can make an affected Outlook installation contact an attacker-controlled network location without its normal external-content warning. The attack needs network connectivity and user interaction; simply receiving an email is not the described trigger.
Microsoft says the exposed information is an NTLMv2 hash, an authentication value that an attacker could use to authenticate as the user. That is not the same as the advisory confirming theft of every victim's readable password. It is nevertheless a reason to prioritise the update rather than rely on spotting a warning that may not appear.
Check Office, not just Windows
For a personally managed supported Office installation, Microsoft's update instructions say to open an Office app such as Word, then choose File, Account, Update Options and Update Now. If offered, enable updates first. Let installation finish and follow any prompts to close applications. Use the genuine application controls, not an update link in an unsolicited email.
If Update Options is missing, Microsoft says the installation may use volume licensing or company policy. Contact the help desk rather than changing workplace settings. Give IT the CVE identifier and ask whether the security update for your product and deployment channel has installed successfully; there is no single build number covering all the products in the advisory.
Keep Windows patched too, but do not treat a completed Windows check as proof of this Office update. The advisory's product table is the place to check scope, rather than assuming every app with Outlook in its name is affected.
Unexpected attachment—or already opened one?
Verify a surprising message file with the sender through a separate, known channel before opening it, even if it appears to come from a colleague. If you already opened a suspicious file on a work device, report the message and approximate time to IT promptly. Installing the update protects against the flaw going forward; it does not prove that earlier authentication exposure has been resolved.
This is distinct from the Outlook Web Access browser attack we covered previously. That earlier webmail report is linked below for context, not as evidence that the Preview Pane or merely viewing an inbox triggers this new desktop-file flaw.
Why switching on a VPN does not patch Outlook
A VPN encrypts traffic between your device and its VPN server. It does not repair Outlook's file handling or guarantee that the application cannot contact an attacker-controlled destination. Updating the affected software and escalating suspected exposure are the relevant actions; buying a consumer VPN is not a remedy for this vulnerability.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.