One Opened Email File Can Hand Attackers Your Outlook Login — Install November's Office Update Now

One employee opening one booby-trapped email file in Outlook can be enough for an attacker to sign in as that person. On Tuesday, November 10, Microsoft released its November Patch Tuesday updates, which fix more than 1,000 vulnerabilities. Only one is confirmed to be under attack right now, and it lives in the program most small offices use all day: Microsoft Outlook.

• What it is: CVE-2026-124194, an Outlook flaw that attackers are already exploiting. CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until the end of the month to patch it.
• How it works: an attacker sends a specially crafted message file. If someone opens it in an unpatched Outlook, Outlook quietly connects to a server the attacker controls, without the usual external-content warning, and can leak the user's Windows login hash (NTLMv2).
• Who is affected: Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
• The fix: this month's Office update, installed through Office itself, not just Windows Update.

Why it matters for your money

Microsoft rates this flaw only "moderate," but Ivanti recommends treating it as critical because it is already being used in real attacks. Tenable's Satnam Narang told The Record that an attack using it may let someone sign in as the victim. A stolen login to email is how most fake-invoice and payroll-change scams start: the attacker reads real conversations, then sends a convincing "new bank details" message from a real inbox. For a small business, one of those wires can wipe out a month of profit, and the money is rarely recovered.

The same release fixes 63 critical flaws, including a Windows Search bug (CVE-2026-116928, rated 9.8 out of 10) that can be triggered when Exchange Server indexes a malicious attachment, with no one opening anything. Microsoft has not reported that one being exploited yet. Google also patched an actively exploited Chrome flaw on November 9, its eighth Chrome zero-day of 2026, and Edge needs the same fix.

What to do this week

1. Update Office on every PC. Open Word or Outlook, go to File > Account (in Outlook it may say Office Account), then Update Options > Update Now. If those buttons are missing on a work computer, updates are managed centrally, so ask whoever runs your IT to confirm.
2. Run Windows Update and restart. Many PCs install updates but never restart, so the fix never takes effect.
3. Update and relaunch Chrome and Edge. Browsers only finish patching after they are fully closed and reopened.
4. Don't open unexpected .msg or email files, even from people you know, and forward anything odd to your IT contact first.
5. Turn on MFA for email if it is not already on, so a stolen login hash or password is not enough by itself.
6. Set a payment rule: any change to a vendor's or employee's bank details gets confirmed by phone, using a number you already have.

For South Texas offices: if nobody can tell you whether your PCs restarted after last month's updates, assume they didn't. For remote-managed clients nationwide: ask your MSP to confirm that the November Office and Windows updates are installed on every machine, not just most of them.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We patch Windows, Office and browsers on a schedule, check that every machine actually restarted, and set up Microsoft 365 security so one stolen login doesn't turn into a stolen payment. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Malwarebytes — Microsoft Patch Tuesday fixes Outlook flaw already under attack (November 11, 2026); The Record — Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row (November 10, 2026); Ivanti — November 2026 Patch Tuesday; BleepingComputer — Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day.