Classic Outlook bug leaks your Windows login: update Office now
If you use classic Outlook on Windows, update Office today. Attackers are exploiting a classic Outlook vulnerability that lets one booby-trapped attachment leak your Windows login to them, and Microsoft’s November update fixes it. Here’s who’s affected, how to install the fix and check it worked, and what to do if you’re on Office 2016 or 2019, which won’t get a patch.
The bug is CVE-2026-124194. Open a booby-trapped message file and classic Outlook quietly connects to a server run by the attacker, skipping the warning it normally shows. Along the way it leaks a scrambled copy of your Windows password, called an NTLMv2 hash, which the attacker can use to pose as you.
Microsoft rates it only Moderate, with a CVSS score of 6.5 out of 10. Don’t let that fool you. It’s the only bug out of more than 1,000 in this month’s release that Microsoft confirms is being exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) has told federal agencies to patch it by November 24, 2026.
Microsoft hasn’t said who is behind the attacks, how long they’ve been going on, or who is being targeted. It does rate the maturity of the attack code as High, meaning working exploits exist.
Which Outlook is affected?
This is a classic Outlook for Windows problem: the desktop program that comes with Microsoft 365 and Office on Windows. Microsoft’s advisory lists Microsoft 365 Apps, Office LTSC 2024 and Office LTSC 2021, in both 32 bit and 64 bit versions. However Outlook in Office 2021 and 2024 are affected too.
| Your Outlook | Affected? | What to do |
| Microsoft 365 subscription, classic Outlook (business, Personal or Family) | Yes | Update Office now |
| Office 2024 or Office 2021 (one time purchase or LTSC) | Yes | Update Office now |
| Office 2019 or Office 2016 | Probably but support has ended | No fix is coming. See below |
| New Outlook for Windows | Not applicable | Nothing for this bug |
| Outlook on the web, Outlook for Mac, iPhone and Android | Not on Microsoft’s list | Nothing for this bug |
One catch for new Outlook fans: classic Outlook is often still installed alongside it, especially with Microsoft 365. If it’s on your PC, update Office anyway.
How to update, and how to check it worked
Microsoft 365 usually updates itself in the background, but “usually” can mean days or weeks. Don’t wait for it.
- Open classic Outlook. Word or Excel works too, since all Office apps share one updater.
- Go to File | Office Account (in Word and Excel it’s File | Account).
- Click Update Options | Update Now.
- Close Office apps when asked and let the update finish.
- Back on the same page, look under About Outlook for the version and build number. Compare it with the table below.
| Office version or update channel | Fixed version (build) or later |
| Current Channel (most home and small business subscribers) | 2610 (20527.20196) |
| Monthly Enterprise Channel | 2610 (20527.20194), 2609 (20430.20264) or 2608 (20326.20320) |
| Semi Annual Enterprise Channel | 2610 (20527.20192), 2609 (20430.20262) or 2608 (20326.20318) |
| Office LTSC 2024 | 2408 (17932.21140) |
| Office LTSC 2021 | 2108 (14334.21048) |
Office 2016 and 2019: no fix is coming
Support for Office 2016 and Office 2019 ended on October 14, 2025. Microsoft doesn’t list them in this advisory because it no longer checks or patches them, not because they’re safe. Assume their Outlook has the same hole, permanently.
This is what “end of support” looks like in real life: an attack in the wild and no patch.
How the attack works
The attack needs one thing from you: opening a file. Here’s the sequence Microsoft describes.
- The attacker sends you a specially crafted message file, typically as an email attachment. Microsoft hasn’t named the exact file type.
- You open it in classic Outlook.
- Outlook connects to a network location the attacker controls. Normally Outlook warns you before it fetches outside content. Here it skips the warning.
- Windows automatically tries to sign in to that location using NTLM, an older Microsoft login method. To do that, it sends your NTLMv2 hash: a scrambled form of your Windows password.
- The attacker keeps the hash.
With that hash, an attacker can try to crack it offline to recover your password, which is quick work if the password is weak. In a company network, they can also relay it to other servers that still accept NTLM and sign in there as you, reaching your files and anything else your account can open.
Reading an email in Outlook’s reading pane is fine; you have to open the attached file. That’s some comfort, but not much, since talking people into opening attachments is the entire business model of phishing.
“Moderate spoofing” is really credential theft
Microsoft files this under spoofing, which makes it sound like a faked sender address. Nothing of the sort happens. The “spoofing” is the attacker impersonating you after stealing your login hash. Call it what it is: credential theft.
The Moderate rating comes from the scoring formula and understates the severity of the security bug. The bug needs you to click, and it leaks information rather than running code on your PC, so it scores 6.5. But scores measure how bad a bug could be in theory, not whether anyone is using it.
For perspective, this month’s release includes 20 Outlook bugs, and three of them are rated Critical. None of those Critical bugs is under attack; this Moderate one is. The good news is that the same November Office update fixes all 20, so one update closes the lot.
Outlook has leaked Windows logins before
This isn’t the first time an Outlook bug has handed attackers your login. Critical Outlook security bug now patched after 11 months covers the 2023 NTLM relay attack, which worked without anyone opening the message, and How Microsoft left an Outlook security hole that’s way too easy for hackers explains how a reminder sound setting was turned into a way in.
Outlook security hole needs quick patching describes a similar NTLM problem from 2024. It also explains why Microsoft’s suggestion to block NTLM could cause more trouble than the bug itself.
If you’re not sure your copy of Office still gets fixes, October 2026 Office Changes: Publisher Dies, Office 2021 Support Ends lists which versions just lost support. October 2026 Patch Tuesday: 173 Office Fixes, 26 Critical Flaws, and Office 2021’s Final Update shows what the last round of patches covered.