Microsoft fixed an Outlook flaw on 10 November that attackers were already using. A user opens one crafted message file, Outlook connects out to an attacker system without the usual warning, and the user's NTLMv2 hash leaves the building.
What happened
The bug is CVE-2026-124194, a spoofing flaw in classic Outlook for Windows. Microsoft's weakness classification is blunt: the product interface does not warn the user of an unsafe action. A specially crafted message file, opened in Outlook, makes the client reach an attacker-controlled network location while skipping the external content warning that would normally appear.
That outbound connection is an SMB authentication attempt, so Windows offers the logged-in user's NTLMv2 hash. The attacker captures it and can relay it live against a file server, an internal web app or anything else that still trusts NTLM, or crack it offline. No credentials and no prior access are needed. The Preview Pane is not the vector, the file has to be opened.
CVSS is 6.5 and Microsoft rates it Moderate, but the CVSS vector marks exploit maturity as High. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 10 November with a 24 November deadline for federal agencies.
Who is affected
Anyone running classic Outlook for Windows, which is most Microsoft 365 tenancies and most on-premises Office estates.
- Microsoft 365 Apps for Enterprise on any update channel that has not taken the November 2026 Office update
- Office LTSC 2024 on a build older than 16.0.17932.21140
- Office LTSC 2021 on a build older than 16.0.14334.21048
The risk is concentrated in environments that still allow outbound SMB and still accept NTLM, which describes most small and mid-sized Windows estates in South Africa.
What to do now
Install the November 2026 Office security updates on every Windows endpoint that runs Outlook, including LTSC and volume-licensed installs that sit outside the monthly channel.
- Confirm the build number on a sample of machines, not just the patch console: 16.0.14334.21048 or later on LTSC 2021, 16.0.17932.21140 or later on LTSC 2024.
- For Microsoft 365 Apps, check that the update channel actually applied the release; deferred and semi-annual channels lag by weeks.
- Block outbound TCP 445 at the firewall and between user and server VLANs. This single rule kills the hash capture on the wire and most NTLM relay paths with it.
- Disable NTLM where the estate allows it, and enforce SMB signing and Extended Protection for Authentication on anything that must keep it.
- Treat any host that opened a suspicious .msg or .eml attachment as a credential compromise, not a user mistake: reset the password and revoke sessions.
What this means for South African businesses
Email is where SA SMEs actually get hit, and this flaw converts a single opened attachment into a usable credential rather than a failed phishing attempt. Most local estates still run NTLM and still allow workstations to talk SMB straight to file servers, so hash relay lands on something useful within minutes.
My read is that the realistic outcome for a 20 to 200 seat company is not a headline breach but invoice fraud or quiet data theft in the days after a successful relay, which is harder to spot than ransomware. Patch first, then close the outbound SMB path, because the patch fixes this file and the SMB rule fixes the class of attack.
Source: Microsoft Security Update Guide, CVE-2026-124194, published 10 November 2026.
Also on the blog
- Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks
- FortiOS OSPF bypass: unauthenticated route injection, fixed in 7.4.13
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.