Insights Security & Privacy
Update Windows and Outlook now: a flaw exposing your login is being used
The short version
Microsoft's November update fixes a flaw in Outlook that attackers were already using. Opening a booby-trapped message file could hand over details of your login. Installing the update closes the gap.
What happened
Microsoft released its monthly security update on 10 November. It fixes more than a thousand flaws across Windows, Office and other products. Only one was known to be under attack.
That one is in Outlook. An attacker sends a specially made message file and persuades the person to open it. Outlook then quietly connects to a computer the attacker controls, without the usual warning about external content.
When that happens, Windows may send along a scrambled form of the user's login details. The attacker can try to unscramble it and use it to reach work accounts. The US cyber agency CISA has added the flaw to its list of exploited vulnerabilities.
Why it matters to you
The attack needs only one person to open a file that looks ordinary. No password has to be typed in, and Outlook does not show its usual external-content warning.
If a login is recovered, the attacker can pose as that person and reach company accounts.
What to do
On Windows 11, go to Start, then Settings, then Windows Update, and select Check for updates. Install everything offered. Windows 10 users on Microsoft's extended support get a separate update.
Until everyone's computer is updated, tell staff not to open message files or attachments they did not expect, even from familiar names. If someone did open one, change their password and tell whoever looks after your IT.
Sources
- CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability Microsoft Security Response Center (opens in a new tab)
- Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day BleepingComputer (opens in a new tab)
- Windows 11 KB5132061 & KB5131087 cumulative updates released BleepingComputer (opens in a new tab)
- Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday CyberScoop (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.