Organizations running affected Outlook desktop versions should deploy Microsoft's November 10, 2026 security update for CVE-2026-124194 promptly. Coordinate the Office update with a review of how suspicious files reach employees and which external connections their computers can make.
The Microsoft advisory was published on November 10, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog that day. Microsoft reports exploitation. Sources were checked on November 11; the first attack date is not disclosed.
What opening the file can trigger
Microsoft describes a specially crafted message file that an attacker persuades someone to open in affected Outlook software. Outlook can then connect to an attacker-controlled network location without its usual external-content warning. Microsoft says the exposed information is an NTLMv2 hash that could be used to authenticate as the user. NTLM is a Windows authentication mechanism.
The sequence is: malicious file → user opens it in affected Outlook → outbound connection without the expected warning → possible authentication exposure. Microsoft explicitly says the Preview Pane is not an attack vector.
The response therefore spans file delivery, client software, and outbound authentication.
Match the update to the installed Office product
The advisory lists 32-bit and 64-bit editions of Microsoft Office Long-Term Servicing Channel (LTSC) 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Match the installed product and update channel to Microsoft's current guidance rather than treating every Office installation as the same package.
The November 10 Office security release notes identify build 14334.21048 for volume-licensed LTSC 2021 and 17932.21140 for volume-licensed LTSC 2024. Microsoft 365 Apps has channel-specific builds. Use the appropriate maintained release for that channel, including a later superseding security update where applicable.
Have the endpoint-management owner confirm the installed result on the affected computers, including laptops that were offline during deployment. Record unresolved devices and their treatment. Updating the mail gateway does not install an Office client fix; those are separate operating responsibilities.
Assign a control to each part of the path
The following comparison applies the advisory's sequence to a managed environment. It is an operational interpretation, not a claim that a particular security product detects this exploit.
| Control | Useful result | Remaining work |
|---|---|---|
| Mail filtering and attachment policy | Inspect messages and files on the covered mail route; handle matches under the agreed policy. | Files obtained through other channels need their own controls. The Outlook installation still needs updating. |
| The applicable Office security update | Repair the affected client software according to Microsoft's release guidance. | Confirm deployment and investigate any suspected exposure that happened earlier. |
| Outbound connection and authentication restrictions | Limit unnecessary external paths and authentication attempts. | Validate business dependencies, remote-device coverage, and the precise restriction. A single blocked port is not a complete remediation claim. |
Network Box USA's Managed Cloud Email Security (MCES) provides attachment checks, message filtering, email-policy enforcement, reporting, and managed operational support. For this review, ask the mail operator to examine the covered delivery routes, relevant attachment handling, and release exceptions. That work can reduce opportunities for malicious files to reach users and supply mail-handling evidence for investigation. No CVE-specific detection claim is established here.
Include files whose contents cannot be inspected. Our protected-attachment guide explains why unreadable content needs an explicit handling decision.
Review outbound authentication without breaking required work
As general hardening, Microsoft's SMB traffic guidance recommends blocking outbound Transmission Control Protocol (TCP) port 445 to the internet, with necessary service dependencies evaluated. Server Message Block (SMB) supports file sharing and other Windows communications. An approved cloud-file requirement needs a deliberately restricted design; it should not silently become permission for every internet destination.
This general hardening is not listed by Microsoft as a complete workaround for this CVE. The advisory does not define every possible transport path, so a port-445 block should not be treated as complete protection.
Network Box USA's Managed Unified Threat Management (UTM+) service combines traffic policy, logging, updates, and operational support. It can enforce agreed restrictions on traffic crossing that gateway. Check separately how off-site laptops reach the internet; an office rule cannot govern a route that bypasses it.
The Windows owner can also review Microsoft's outgoing NTLM policy. Microsoft recommends auditing usage before denial because restrictions can affect applications and services. Use the audit to identify required destinations, test proposed changes, and approve narrowly justified exceptions. That identity and endpoint policy requires its own owner; it is not implied by a managed firewall subscription.
If someone already opened a suspicious file
Use the established incident-reporting route. Give responders the affected user and device, the approximate opening time, the file's source, and available message or connection references. Preserve the original evidence through the approved process rather than asking employees to reopen the file for a test.
The incident team should assess possible authentication exposure and choose the necessary account and device actions, including investigation of activity before the update.
To review the managed email and gateway portions of this exposure, contact our team with your Office environment, mail routes, and remote-working arrangements. Keep suspicious files and credentials out of the form; arrange evidence transfer through an agreed secure channel.