Microsoft’s November Patch Tuesday Fixes an Outlook Zero-Day Already Under Attack: What Australian Users Need to Do

Microsoft has released one of the largest security updates in its history, and buried inside it is a flaw that attackers are already using. The November 2026 Patch Tuesday, released on Tuesday 10 November, fixes 1,235 vulnerabilities across Microsoft products, according to BleepingComputer’s count. Only one is confirmed to be under active attack, and it lives in Outlook, the email app used by millions of Australian homes and businesses.

The flaw, tracked as CVE-2026-124194, can expose a user’s Windows login credentials when they open a specially crafted message file. Microsoft has confirmed that attacks are happening now. The catch is that the fix does not arrive through Windows Update. Outlook is patched through Office’s own updater, which many people never open.

What the Outlook zero-day does

Microsoft describes CVE-2026-124194 as a spoofing vulnerability in Outlook and rates it Moderate, with a CVSS score of 6.5. That sounds mild, and on paper it is. In practice, the rating misses the point, because this flaw is already being used in real attacks, while most of the other flaws fixed this month exist only in theory so far.

The attack works like this. A victim opens a specially crafted message file in Outlook. Instead of showing the usual warning about external content, Outlook silently connects to a network location controlled by the attacker. That connection can disclose the user’s NTLMv2 hash, a scrambled version of their Windows login credentials, which an attacker can then try to crack offline or use to pose as the user.

Two details matter. First, the Preview Pane is not an attack vector, so simply seeing a message in your inbox list will not trigger anything. The victim has to open the malicious file. Second, Microsoft has not published details of the attacks, and it has not identified the attackers, the victims or the scale. What is confirmed is that exploitation is happening, which is why the United States Cybersecurity and Infrastructure Security Agency, CISA, added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November and set a remediation deadline of 24 November 2026 for United States federal agencies.

The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and Office LTSC 2024, in 32-bit and 64-bit versions. Microsoft credits a researcher using the name “nono” and security researcher Benoit Sevens with reporting it.

Why this update is so big

Microsoft’s own count puts the number of Microsoft assigned flaws at about 1,093, while BleepingComputer’s total of 1,235 includes 142 flaws in Microsoft Edge, which is based on Chromium. Either way, it is the second largest Patch Tuesday on record, one month after the largest.

Security researchers counted 66 flaws rated Critical this month, along with 20 remote code execution flaws in Outlook alone, plus fixes for domain controller LDAP and Active Directory bugs, Exchange, kernel network stack flaws and Hyper-V. The Zero Day Initiative classified 30 of the patched flaws as potentially wormable. Yet only one flaw, the Outlook zero-day, is confirmed exploited.

The trap: Windows Update will not fix Outlook

Here is the detail that will catch many Australian users out. Installing the Windows cumulative update does nothing for this bug. The Outlook fix comes through Office’s own update channel and has to be installed separately.

To update Office, open Outlook or Word, go to File, then Account, then Update Options, then Update Now. Wait for the update to download and install, then restart Outlook. If your workplace manages updates centrally, your IT team may push the fix for you, but check that the Office update has actually landed, since many organisations patch Windows promptly and Office less often.

The Windows side still needs doing. The Windows 11 November update is KB5132061 for versions 24H2, 25H2 and 26H2, and KB5131087 for 23H2. Install it from Settings, then Windows Update, then restart the computer. Microsoft lists no known issues with the Windows update at release.

What Australian users and businesses should do now

For home users, the steps are simple. First, update Office from inside Outlook or Word, using File, Account, Update Options, Update Now. Second, run Windows Update and restart. Third, be extra careful with unexpected email attachments until you have updated, and treat any message that asks you to open an attached file with suspicion, even if it looks like it comes from someone you know.

For Australian businesses, the priority is the same, but the scale is bigger. Any computer running Outlook is exposed until the Office update lands. IT teams should confirm the Office update has reached every machine, not just the Windows update, and treat 24 November, the CISA deadline for United States federal agencies, as a useful target date.

This has been a rough week for Microsoft in Australia. On Friday 13 November, a Microsoft 365 outage hit organisations across the country, including the Australian Security Intelligence Organisation and the Australian Federal Police, with users unable to access Outlook, Teams and other services for hours. Microsoft said it did not believe the outage was caused by a cyber attack. The outage and the zero-day are separate events, but together they are a reminder of how much Australian work now depends on a small number of Microsoft services.

What to watch next

The immediate question is how widely the Outlook flaw is being used. Microsoft has not published indicators of compromise, and no security firm has yet described the attacks in detail. Watch for updates from Microsoft’s Security Response Center and from CISA.

The longer question is whether the other Critical flaws fixed this month start to see exploitation. History suggests some will. That is why the standard advice has not changed: patch promptly, patch everything, and do not assume that a Windows Update prompt saying you are current means every app on the machine is current too.

Frequently Asked Questions

What is CVE-2026-124194?

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook, rated Moderate with a CVSS score of 6.5. If a user opens a specially crafted message file, Outlook can connect to an attacker controlled network location without its usual warning, which can disclose the user’s NTLMv2 login hash.

Does Windows Update fix the Outlook zero-day?

No. The Outlook fix comes through Office’s own updater, not Windows Update. Open Outlook or Word, go to File, then Account, then Update Options, then Update Now. You should also install the Windows 11 November update, KB5132061, but that alone does not fix Outlook.

Am I at risk if I only read emails in the Preview Pane?

No, according to Microsoft. The Preview Pane is not an attack vector for this flaw. The attack requires the user to open the malicious message file. Even so, updating Office promptly is the safest step.