A seemingly harmless click could give cybercriminals a path into your digital accounts.
Microsoft Outlook users are being urged to update their software after attackers began exploiting a security vulnerability that can expose credentials used to confirm a person’s identity.
Opening a specially modified message file in a vulnerable version of Outlook can force the application to connect to a network location controlled by attackers.
That connection may disclose authentication data, which criminals could exploit to impersonate victims or gain access to business systems and online accounts.
Microsoft issued a fix in its November 10 security release. However, computers remain exposed until the relevant Office update has been installed.
To update, open an Office app such as Word, select File, choose Account, then select Update Options and Update Now.
In some older versions of Outlook, the account section may be labelled Office Account instead.
Because this repair is distributed through Office, checking Windows Update by itself will not confirm that the Outlook vulnerability has been fixed.
Outlook users are being urged to install the latest Office update after hackers began exploiting a flaw capable of exposing identity-verification data
The flaw is already being exploited, turning the alert into an immediate security warning rather than a hypothetical risk.
NHS England’s cybersecurity advisory says Microsoft has confirmed attacks are taking place. The US Cybersecurity and Infrastructure Security Agency has also added the vulnerability to its Known Exploited Vulnerabilities catalog.
The issue stems from a missing warning that should normally notify users before Outlook connects to potentially dangerous external content.
Until the patch is installed, users should avoid opening unexpected attachments and message files, even when they appear to have been sent by someone they know.
Anyone uncertain about a file should contact the supposed sender using a separate, trusted communication channel before opening it.
Applying the update removes this specific weakness, but Microsoft’s release does not guarantee that every vulnerable device has already received it.
Some computers may have installed the patch automatically, while others still require action from the user or an organisation’s IT team.
If the Update Now option is missing, Microsoft advises selecting Enable Updates first.
A maliciously crafted Outlook message file can prompt a connection to an attacker-controlled network location
Users should save any open work and follow instructions to close Office applications if prompted, allowing the installation to complete.
On a business computer, the absence of update controls may indicate that the device is managed by the employer’s IT department.
In that case, users should contact the help desk and verify that the Office security patch has been deployed.
Without the missing warning, a person opening the booby-trapped file may receive no clear indication that sensitive authentication data is being sent to an outside location.
The exposed information is known as an NTLMv2 hash. It is used as part of the process Windows services rely on to verify a user’s identity.
Although it is not a plain-text version of a password, attackers may still be able to misuse the hash to impersonate its owner.
The impact depends on the victim’s permissions and the security measures protecting their accounts and network.
On a work device, a compromised digital identity could provide attackers with an entry point to systems holding confidential company information.
The documented attack requires the victim to open a specially crafted message file. Simply receiving a regular email does not trigger the same attack.
Microsoft’s broader November security package fixes more than 1,000 vulnerabilities across its products, including additional flaws that could enable malicious code to run.
Windows users should also open Settings, select Windows Update and check for available patches, then complete any restart the system requests.
That step is important, but it should be carried out alongside the Office update check, not used as a substitute for it.
The Outlook vulnerability is identified as CVE-2026-124194, the reference number IT teams can use to locate the relevant security advisory and patch.