Attackers are using an Outlook flaw to steal Windows logins from one opened file. Install this week's Office update, and relaunch Chrome too

Microsoft's November Patch Tuesday on Nov 10 fixed 1,093 vulnerabilities, and one of them is already being used in attacks: an Outlook flaw tracked as CVE-2026-124194, per Ivanti and The Record. CISA added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Nov 24 to patch, per SecurityOnline.

What the flaw does. An attacker sends a specially crafted message file and gets someone to open it in Outlook. Opening it makes Outlook connect to a server the attacker controls without showing the usual external-content warning, and that connection hands over the user's NTLMv2 password hash, per BleepingComputer. The attacker can relay that hash to sign in to other systems as the user or try to crack it to recover the password, per CSO Online. Microsoft says the Preview Pane is not a way in, so the file has to be opened.

Don't let the score fool you. Microsoft rates it only Moderate, with a CVSS score of 6.5, but working attack code exists and it is being used now. Ivanti recommends treating it as Critical. Microsoft hasn't said who is behind the attacks or how many people were hit.

Who's affected. Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The fixed LTSC builds are 16.0.14334.21048 and 16.0.17932.21140.

Chrome too. On Nov 9, Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux to fix CVE-2026-125350, a bug in how Chrome handles XML that attackers are already exploiting, per Google's release notes. It's Chrome's eighth exploited zero-day this year, per The Hacker News. Edge and other Chromium-based browsers need the same fix as their updates arrive.

Action item: Patch Office and browsers this week.
1. Update Office on every PC that runs Outlook. In Outlook, go to File > Office Account > Update Options > Update Now. If you manage updates centrally, confirm the November Office updates actually reached each machine.
2. Relaunch Chrome and Edge. The fix doesn't apply until the browser restarts. Check Help > About Google Chrome and confirm you're on 157.0.8103.50 or later.
3. Tell staff not to open unexpected message files, even from people they know, until Office is patched.
4. Block outbound SMB to the internet. SecurityOnline suggests blocking outbound SMB and NTLM traffic at the firewall, which stops this kind of hash leak from reaching an outside server.

Not sure every PC got the update? Call us at +1 (689) 225-0286.