Outlook Zero-Day Fixed: What to Update on Your PC Tonight

Microsoft patched an Outlook zero-day on 10 November 2026, and it’s the one bug in this month’s huge update that attackers are already using. If you use the Outlook desktop app on Windows, update Office today from File > Office Account > Update Options > Update Now, then run Windows Update as well.

Here’s the part most people will miss: Windows Update on its own may not fix Outlook. That catch is in section 4.

What Is the Outlook Zero-Day Microsoft Just Fixed?

A zero-day is a flaw that attackers were using before a fix existed. This one is CVE-2026-124194, and Microsoft’s own advisory marks it “Exploitation Detected”.

Microsoft describes it plainly. An attacker sends a specially crafted message file and convinces you to open it in an affected version of Outlook. Outlook then connects to a network location the attacker controls, without showing the usual warning about external content.

That silent connection can hand over your NTLMv2 hash. Think of it as a scrambled copy of your Windows sign-in, the thing your PC shows to file servers and printers on an office network. Microsoft says an attacker “could use this to authenticate as the user”, and BleepingComputer notes such hashes can also be cracked offline.

It is not a “your PC explodes when an email arrives” bug. The rating is Moderate, you have to open the file yourself, and simply previewing a mail doesn’t trigger it. Still, it’s the only flaw this month with real attacks behind it, which is why it goes first.

Who Needs to Hurry and Who Can Relax

Not everyone reading this has the same risk. The stolen item here is a Windows network sign-in, so the people with the most to lose are those whose laptops log in to a company network.

Microsoft’s affected list for this CVE names three products: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in both 32-bit and 64-bit. It doesn’t mention Outlook.com, the Outlook phone apps or Outlook on Mac.

One honest gap: Microsoft’s list doesn’t say anything about the new Outlook app that ships with Windows 11. I wouldn’t assume either way. Update it from the Microsoft Store and move on.

The US cyber agency CISA added this flaw to its Known Exploited Vulnerabilities list on 10 November and gave federal offices until 24 November to patch. That’s a fair deadline for the rest of us too. If you patched Chrome after last week’s alert, this is the same drill; our Chrome zero-day version check has those steps.

Also readChrome Zero-Day Is Being Exploited: Check Your Version Today

Step 1: Update Office to Patch the Outlook Zero-Day

This takes a few minutes on decent Wi-Fi. Microsoft’s support page gives these steps for Windows:

1. Open any Office app, such as Word, and create a new document.
2. Click File > Account. In classic Outlook, it’s File > Office Account.
3. Under Product Information, click Update Options > Update Now.
4. If you don’t see Update Now, click Enable Updates first.
5. Wait for the “You’re up to date” window, then close it and reopen Outlook.

Office updates all its apps together. So updating from Word also updates Outlook, Excel and PowerPoint.

What if Update Options is missing?

If you only see an About button, Microsoft says you probably have a volume licence install, or your company manages Office updates through Group Policy. That’s common on office laptops. Message your IT team and mention CVE-2026-124194, because they control when your update lands.

The Catch: Windows Update Alone May Not Fix Outlook

Office can update itself in the background when updates are enabled. But you can’t see from Windows Update whether that has happened yet, and many of us leave Outlook running for weeks. Pressing Update Now removes the guesswork.

How to check you got the fix

Go to File > Office Account in Outlook and look at the version line next to About Outlook. Microsoft’s release notes list these builds for 10 November 2026:

If your build number is the same or higher, you’re patched. Office laptops on Monthly Enterprise or Semi-Annual channels show different numbers, so let IT confirm those.

Step 2: Run Windows Update on Windows 11 or 10

The Outlook zero-day is the headline, but the Windows patch matters just as much. BleepingComputer counts 1,235 flaws fixed this month, 66 of them rated Critical. Security Affairs puts the figure near 1,090. The totals differ because outlets count Edge and earlier fixes differently, so don’t get stuck on the number.

Windows 11

1. Click Start > Settings > Windows Update.
2. Click Check for updates.
3. Install KB5132061 or KB5131087, whichever your version is offered, then restart.

BleepingComputer reports that Microsoft isn’t aware of any new issues with these updates so far. One reader comment there mentions install failures, which is unconfirmed. If yours fails, restart and try once more before worrying.

Windows 10

Go to Start > Settings > Update & Security > Windows Update and check for updates. You’ll get KB5131096 (build 19045.7846) only if the PC is enrolled in Extended Security Updates, or runs Enterprise LTSC.

Windows 10 support ended on 14 October 2025. Microsoft’s ESU page now says the consumer programme runs until 12 October 2027, and enrolment is still open. If your old family desktop shows no November update at all, it probably isn’t enrolled. Fix that first.

Restart when asked. A pending restart means the patch isn’t active yet. And if the laptop dies halfway through updates, check its battery with our laptop battery health guide.

Also readTwo-Step Verification on WhatsApp, Gmail, Instagram in 10 Minutes

Until You Update: Habits That Block This Attack

The attack needs you to open a file. So your own caution works as a patch until the real one arrives.

• Don’t open message files from strangers. Microsoft only says “specially crafted message file” and doesn’t name the type. Treat any attached email file, like .msg or .eml, as suspect unless you were expecting it.
• Be wary of “forwarded mail” attachments. A real colleague forwards a mail in the body. An attached message file from an unknown vendor or “HR team” is a red flag.
• Add a second lock. A leaked sign-in hurts less when accounts need a second step. Set up two-step verification, or go further with passkeys.

One more thing for small offices, the CA firm or the coaching centre with five PCs and no IT person. Somebody has to own this. Pick one person, give them twenty minutes, and have them press Update Now on every machine.

Frequently Asked Questions

What is the Outlook zero-day CVE-2026-124194?

It’s a spoofing flaw in the Outlook desktop app that Microsoft fixed on 10 November 2026. Opening a crafted message file can make Outlook contact an attacker’s server without a warning and leak your NTLMv2 hash. Microsoft rates it Moderate and confirms it has been exploited.

Does Windows Update fix the Outlook bug?

Not by itself for most people. Microsoft delivers this fix through Office security updates, so open Outlook and use File > Office Account > Update Options > Update Now. Run Windows Update too, because it carries the rest of November’s fixes.

Can I get hacked just by receiving the email?

Microsoft says no. The Preview Pane is not an attack vector for this flaw, and the attacker has to convince you to open the malicious file.

Is Outlook.com or Outlook on my phone affected?

Microsoft’s affected list names only desktop Office: Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Outlook.com and the phone apps aren’t on it. Keep your phone apps updated anyway.

Will Windows 10 get the November 2026 update?

Only enrolled PCs. KB5131096 goes to Windows 10 devices in the Extended Security Updates programme and to Enterprise LTSC. Microsoft says consumer ESU runs until 12 October 2027.

The Bottom Line

The Outlook zero-day is a Moderate bug with real attacks behind it, and the fix sits in Office, not in Windows Update. Open Outlook now, press Update Now, then run Windows Update and restart. After that, check the build number once so you know it worked.

Sources

• Microsoft Security Update Guide: CVE-2026-124194 (severity, exploitation status, FAQ, affected products)
• Microsoft Learn: Microsoft 365 Apps security update release notes (10 Nov 2026 builds)
• Microsoft Support: install Microsoft 365 updates
• Microsoft Support: install Windows updates
• Microsoft: Windows 10 Extended Security Updates programme
• CISA: Known Exploited Vulnerabilities catalog (added 10 Nov, due 24 Nov 2026)
• BleepingComputer: November 2026 Patch Tuesday fixes 1,235 flaws
• BleepingComputer: Windows 11 KB5132061 and KB5131087 released
• BleepingComputer: Windows 10 KB5131096 extended security update
• Security Affairs: one exploited Outlook bug and 30 wormable flaws