Microsoft Warns Attackers Are Exploiting Outlook Bug, Issues Fix
Microsoft warned that attackers are exploiting an Outlook flaw, CVE-2026-124194, that can leak login credentials when a user opens a tampered message file. A fix shipped November 10, 2026. A separate bug also bounced some emails to Outlook.com and Hotmail addresses.
Microsoft has warned that attackers are actively exploiting an Outlook bug, tracked as CVE-2026-124194, and has fixed it in security updates released November 10, 2026. The flaw can expose a user's login credentials.
Attackers trick a user into opening a tampered message file. Outlook may then connect to a server the attacker controls, without showing the usual security warning. Stolen authentication credentials could be used to impersonate the victim.
The user must open the malicious file for the attack to work.
Who is affected
The affected products include Microsoft 365 for business, as well as Office LTSC 2021 and 2024. Microsoft rates the vulnerability as moderately severe. Because exploitation is confirmed, security writers are still urging people to install the update.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its list of known vulnerabilities that attackers are exploiting.
It is one of 1,093 vulnerabilities Microsoft addressed in its November updates, according to the security firm Tenable. Of those, 63 are classified as critical.
How to update
Office can normally be updated through the account settings inside the program. Business users may need to contact their IT department.
A separate email bounce bug
Outlook users faced a different problem in recent days. A mistake in spam enforcement rules caused some messages sent to Outlook.com, Hotmail, Live and MSN addresses to be rejected and bounced back to senders.
Microsoft said in an incident report: "Some users may intermittently be unable to send email messages to Outlook.com, Hotmail.com, or Live.com email addresses." The company has rolled back the update that contained the problem, so normal delivery should be restored.
Affected messages did not land in spam folders. Recipients therefore have no way to find them. Anyone expecting an important message that never arrived may need to ask the sender to resend it.
Senders can check for non-delivery reports, also called bounce messages. Errors naming Outlook.com, Hotmail.com, Live.com or MSN.com, or codes such as "550 5.7.1" and "AS9031519", could indicate a rejection during the incident.
Reports from affected users suggested the fault was intermittent. Some messages bounced at first and went through when sent again later. Microsoft 365 business mailboxes were not the focus of the reported delivery failures.
