A security flaw in Outlook can expose information used to authenticate an employee. Microsoft says attackers are already exploiting it and released a fix on 10 November 2026. Norwegian businesses that use affected Office products should ask their IT team or provider to check which computers need the update and confirm that it has actually been installed.
The issue is identified as CVE-2026-124194. It has a severity score of 6.5 out of 10, which Microsoft rates moderate. That score should not be the only factor in the decision: Microsoft also reports that exploitation has been detected. A flaw with a lower score can still deserve urgent attention when attackers are using it and the affected software is important to your business.
What Microsoft says can happen
According to Microsoft's security advisory, an attacker can send a specially crafted message file and try to persuade someone to open it in an affected version of Outlook. Opening the file may cause Outlook to connect to a network location controlled by the attacker without the usual warning about external content.
Microsoft says this can disclose an NTLMv2 authentication hash that an attacker could use to authenticate as the user. A hash is not the user's plain-text password. Exposure does not by itself prove that an attacker accessed the account or every service the employee can use, but it requires a security assessment because it may help an attacker impersonate that user.
The advisory says network connectivity and user interaction are required. Microsoft also states that Outlook's Preview Pane is not an attack vector for this specific flaw. This is not evidence that merely receiving any ordinary email compromises a computer, and the company has not identified Norwegian victims in the advisory.
Microsoft credits two researchers, including one who used Claude, in its acknowledgment. That describes assistance with discovery; it does not establish that the attackers used AI. The immediate business decision is the same either way: identify affected installations and get the correct fix in place.
Which products should be checked?
As of 11 November, Microsoft's advisory lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and LTSC 2024 for 32-bit and 64-bit Windows systems. The official CVE record, assigned by Microsoft, identifies versions below these builds as affected:
- Office LTSC 2021: build 16.0.14334.21048 is the listed fixed build.
- Office LTSC 2024: build 16.0.17932.21140 is the listed fixed build.
- Microsoft 365 Apps for Enterprise: consult Microsoft's Office security release notes for the applicable update channel and build.
Those product names are specific. The advisory does not establish that every Outlook product or every unlisted Office edition is either affected or unaffected. If your organisation uses another edition, older software, a managed device or a service whose version you cannot identify, ask the provider or Microsoft to confirm its status. Do not assume that an update for one channel is the correct build for another.
The CVE record also includes CISA's indication of active exploitation. CISA's US federal remediation deadlines are not automatically Norwegian legal deadlines. They are another reason for a Norwegian IT team to treat the advisory as actionable, while assessing its own systems and obligations.
Ask for proof that the fix reached the computers
Imagine a small Norwegian engineering company. Most staff work on managed Windows laptops, but two employees use devices that were offline during the scheduled update. The business relies on an external IT provider. This is a hypothetical example, not a report of a customer incident.
The manager's request should be short and specific:
- Identify devices with the affected Office products and their update channels, including laptops that have not connected recently.
- Install the appropriate update and verify the installed build, rather than treating an update notification or a policy setting as proof of completion.
- List devices that could not be checked or updated, the reason, the person responsible and when the issue will be revisited.
- Check with the provider how employees should report an unexpected message file or a suspected exposure, and how the provider will investigate.
Norway's National Security Authority recommends prompt, largely automatic security updates, including for software that reads external content. A small AS can delegate the technical work to its IT provider, but it still needs a named contact and a clear answer about exceptions.
If someone may have opened a suspicious file
Ask the employee to report it promptly through the company's agreed channel and preserve the message and relevant information for the security team. Involve your IT provider or incident-response specialist; they can assess the device, account activity, access to internal services and whether credentials or sessions need to be reset. Do not conclude that an account has been taken over simply because the file was received.
Network and authentication restrictions can reduce exposure in some environments, but their effect depends on the company's configuration and how the vulnerability is exploited. Have qualified staff assess and test them. They do not replace the update, and changes must not silently break business services.
A useful staff message is direct: do not open unexpected message files, report anything suspicious, and install or restart when the IT team instructs you to do so. The responsibility for a safe update process rests with the organisation, not only with the employee who receives a suspicious file.
A management question, not a new board project
Management owns the inventory, update and incident response. If a material system cannot be updated, it should decide with the IT provider how to reduce exposure and when the exception must be reviewed. The board does not need to direct individual Office patches. It should expect management to know whether critical updates are installed and whether serious exceptions are being resolved.
This case also illustrates the broader decision about security updates: a severity score, actual exploitation and the business context each answer different questions. A useful response connects the advisory to the devices people actually use and records what remains unprotected.
Sources checked on 11 November 2026. The engineering company is hypothetical. Microsoft and CISA provide the cited technical information; the management recommendations are the author's analysis. The illustration is AI-generated.