Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes 1,093 vulnerabilities across Windows, Office, Azure and server products. One of them is already being used by attackers right now: an Outlook spoofing flaw tracked as CVE-2026-124194 — and it's especially dangerous because it needs almost nothing from the victim.
According to Qualys's analysis of the patch, an unauthenticated attacker only needs to send a specially crafted message file and convince the recipient to open it in Outlook. When the victim opens it, Outlook may silently connect to an attacker-controlled server — without showing the usual warning about external content. That connection can leak the user's Windows authentication information straight to the attacker.
Why this one is different from "just another phishing email"
Most phishing attacks rely on the victim clicking a link, downloading an attachment, or entering a password on a fake login page. This flaw skips all of that. Simply opening the message in Outlook can be enough to trigger the leak, and because the external-content warning doesn't appear, there's no visual red flag telling the employee something is wrong.
What gets stolen is an NTLMv2 hash — effectively a stand-in for the user's Windows password. As Splashtop explains, attackers can use this hash to authenticate as the victim, opening the door to follow-on attacks across the rest of the network: accessing file shares, other internal systems, or email accounts under that person's identity.
Confirmed under active attack — with a deadline
CISA has added CVE-2026-124194 to its Known Exploited Vulnerabilities Catalog, confirming it has evidence of real-world exploitation — this is not a theoretical risk. CISA has set a remediation due date of 24 November 2026. That's the outside limit; in practice, every day this stays unpatched is a day your Windows credentials could already be in someone else's hands.
The flaw sits alongside more than a thousand other fixes in this month's release, covering Windows, Office, Azure and server products, as detailed in the full November 2026 Patch Tuesday summary. But the Outlook issue is the one that needs attention today, given it is already being exploited and Outlook is used by nearly every Swiss business on a daily basis.
What to do today
- Install the November 2026 security updates for Windows and Office across all devices — workstations, laptops, and any machine running Outlook, including remote and home-office setups that are easy to forget.
- Prioritise Outlook and Windows updates over less urgent patches if you can't roll out all 1,093 fixes at once. This specific flaw is the one attackers are using right now.
- Check your patch management tooling actually reached every device — especially laptops that were off during the automatic update window, and any machines managed outside your central IT system.
- Remind staff that opening an unexpected email from an unknown or unusual sender is risky even without clicking anything — standard phishing training that focuses only on "don't click links" won't cover this one.
- Review NTLM usage in your network if you have the technical means to do so; moving away from NTLM authentication toward more modern protocols reduces the damage even if a hash does leak.
If you don't have a dedicated IT team tracking Patch Tuesday releases every month, this is exactly the kind of gap that gets exploited quietly. Flitz.ai, provided through The Mejlerö Company GmbH in Engelberg, helps Swiss SMEs in Obwalden, Nidwalden, Lucerne and Zurich keep Windows, Microsoft 365 and endpoint security current as part of day-to-day IT support — including a free network analysis to see where your current setup stands.
We'll keep watching this space. AI-assisted attacks and software vulnerabilities are now a routine part of running a business, and we'll keep reporting the ones that matter most for keeping your websites, servers and IT equipment safe.
Switzerland.