[Digital Today reporter Jae-won Choi (최재원)] Microsoft has fixed an Outlook security vulnerability that was exploited in actual cyberattacks and urged users to update quickly. The flaw can connect to an external server without a separate warning when a malicious file is opened, potentially leaking Windows authentication credentials.

On Nov. 11 (local time), Taiwan media outlet ITHome reported that Microsoft fixed the Outlook vulnerability, CVE-2026-124194, in its November monthly security update released the previous day. Microsoft confirmed the vulnerability had already been used in actual attacks.

The issue is that Outlook does not warn users about risky external connections. An attacker can send a specially crafted message file without separate account authentication and prompt a recipient to open it in Outlook.

When the file is opened, Outlook can connect to a network location controlled by the attacker and skip the external content access warning that is normally shown.

This process carries the risk of exposing an NTLMv2 hash used for Windows authentication. An attacker can use the captured hash to impersonate a user or attempt follow-on attacks to gain unauthorized access to other systems.

The attack does not succeed simply by receiving the email or viewing it in the preview pane. Actual exploitation requires the user to open the manipulated file and connect to an external network.

Microsoft classified the vulnerability as spoofing and assigned it a Common Vulnerability Scoring System score of 6.5 and a severity rating of medium. Swift action is required because it is a zero-day vulnerability that was used in attacks before the security patch was disclosed.

Affected products include Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024. Users need to check separately from Windows Update whether an Office security update has been applied.

The November monthly update fixed more than 1,000 security vulnerabilities. Tenable tallied 1,093, of which 63 were classified as critical.

The U.S. Cybersecurity and Infrastructure Security Agency also added the Outlook flaw to its catalog of known exploited vulnerabilities. The deadline for action by U.S. federal agencies is the 24th.

No specific exploitation cases, such as the attacker and the scale of damage, have been disclosed so far.