Patch Tuesday zero-day: an Outlook flaw that leaks NTLMv2 hashes when a user opens a crafted message file is already being exploited (CVE-2026-124194)
- Fixed builds: Office LTSC 2024 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048; Microsoft 365 Apps on Current Channel 2610 build 20527.20196 and the matching Monthly/Semi-Annual Enterprise builds listed in Microsoft's Office release notes.
- Not a Windows update: a fully patched Windows dashboard says nothing about Office click-to-run builds; check the Outlook build on endpoints.
- Credit: MSRC acknowledges "Benoît Sevens using Claude with Anthropic" and "nono". Microsoft hasn't said who is exploiting it or how widely.
- Severity label vs. reality: it's the only exploited Microsoft bug this month and outranks the higher-scored Criticals. See the hunt and tip items for detection and NTLM hardening.
Sources: MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability · CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026) · Microsoft Learn: Release notes for Microsoft Office security updates (Nov 10, 2026) · Tenable: Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (Nov 10, 2026)