Microsoft’s November 10 security updates address CVE-2026-124194, an Outlook spoofing vulnerability that the company confirms was exploited before a fix became available.
The attack requires a user to open a specially crafted message file in an affected Outlook installation. HKCERT’s advisory says the file can trigger a connection to an attacker-controlled network location without the usual external-content warning, potentially exposing authentication information usable for impersonation. Network access and user interaction are required.
Microsoft urges affected customers to install security updates promptly. Administrators should deploy the applicable Office update and check the installed build against their product and update channel.
Microsoft’s Office release notes list November security builds including 14334.21048 for Office LTSC 2021 and 17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, the Current Channel release is Version 2610, Build 20527.20196; other channels have separate builds.
The confirmed exploitation makes this Outlook fix a practical priority when planning November’s update rollout.
