Outlook spoofing flaw CVE-2026-124194 was exploited before the fix
Microsoft patched an Outlook bug that could open a connection to an attacker's server without the usual warning, leaking Windows login data. It was already being exploited.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesOpening a booby-trapped message file in Outlook could quietly send your Windows network login data to an attacker's server, with none of the warnings you would normally see. Microsoft has now fixed the Outlook spoofing vulnerability, tracked as CVE-2026-124194, and it was being exploited before the patch arrived.
The fix came in Microsoft's November security update, released on 10 November (US time). According to a notice from Japan's JPCERT/CC, a specially crafted message file opened in Outlook can connect to a server controlled by the attacker without the usual warning. The data that leaks is what Windows uses for network authentication, and whoever gets it may be able to pass authentication as you.
This is not the familiar kind of email spoofing, where the sender address is faked. It happens inside the recipient's own computer.
Which versions of Outlook are affected?
The flaw affects unpatched versions of classic Outlook for Windows included in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
How to protect yourself from CVE-2026-124194
Install the latest security updates for Office, Outlook included. You can check Windows Update or Microsoft Update. In classic Outlook, you may also be able to update by hand via File, Office Account, Update Options, Update Now. Japan's IPA has warned that damage may spread and urged people to apply the update promptly. If your company manages updates, follow your IT department's instructions.
Why so many patches?
This month's update fixed 1,093 vulnerabilities by CVE number, 63 of them rated critical. For comparison, November 2021 had 55, and security firm Tenable counted 1,130 for all of 2025.
The UK's National Cyber Security Centre said in May 2026 that AI is speeding up the discovery of vulnerabilities and told organisations to prepare for waves of patches. It also says the time between a flaw going public and being exploited is already down to days, and AI will almost certainly shorten it further. Defenders have to close every hole, while an attacker needs only one.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
More in: Security
See all →
Cyber Security Cloud GitHub leak: one stolen login exposed customer data
wfx-loot attack hit 61,000 GitHub repos to steal secrets
SignDrop Windows zero-day turns Defender against itself
