One seemingly harmless click could give cybercriminals a route into your digital accounts.
Microsoft Outlook users are being told to install the latest software update after attackers began exploiting a vulnerability that may expose information used to confirm a person’s identity.
In affected versions of Outlook, opening a specially designed message file can force the application to connect with a network location operated by attackers.
That connection may disclose authentication data, which criminals could use to impersonate the user or try to enter company systems.
Microsoft issued a repair in its November 10 security release, but devices remain at risk until the relevant Office update has been installed.
To check for it, open an Office program such as Word, go to File, select Account, then choose Update Options and Update Now.
Users running classic Outlook may see the option labelled Office Account instead.
Since this particular fix is distributed through Office, checking Windows Update on its own will not confirm that the Outlook vulnerability has been patched.
Outlook users are being urged to install a security update after hackers began exploiting a flaw that could expose identity-verification data
The flaw is already being exploited, turning the advisory into an immediate security warning rather than a hypothetical risk.
NHS England’s cybersecurity guidance says Microsoft has confirmed attacks, while the US Cybersecurity and Infrastructure Security Agency has listed the issue among its known exploited vulnerabilities.
The security weakness stems from Outlook failing to display a warning before connecting to potentially dangerous external content.
Until the patch is in place, users should be cautious with unexpected attachments and message files, even when they appear to come from someone they know.
If a file seems questionable, verify it with the sender using a separate trusted channel before opening it.
Applying the update addresses this specific flaw, but Microsoft has warned that its release does not guarantee every affected computer has already received it.
Some machines may have installed the patch automatically, while others could require action from the user or an organisation’s IT team.
FIND OUT MORE: Fatal Brooklyn Collapse Linked to Nearby Construction: Live Updates
If the Update Now option is missing, Microsoft advises selecting Enable Updates first.
A specially crafted message file can make an affected Outlook version connect to a network location controlled by attackers
Before starting the installation, save any work in progress and follow instructions to close Office applications if prompted.
On a work-issued computer, the absence of update controls may indicate that software updates are managed centrally by the employer.
In that situation, users should contact their IT help desk and ask whether the Office security patch has been deployed.
Because the usual warning is missing, a person who opens the malicious file may not realise that sensitive authentication information is being sent outside the organisation.
The exposed data is known as an NTLMv2 hash, which helps verify a user’s identity when connecting to certain Windows services.
Although it is not a plain-text version of the user’s password, attackers may still find ways to misuse it and act as that person.
The possible impact will vary according to the victim’s permissions and the security measures protecting their accounts and network.
On a business device, a stolen digital identity could provide attackers with an entry point to systems holding confidential information.
The attack requires the victim to open a specially crafted message file; simply receiving a normal email does not trigger the same risk.
Microsoft’s broader November security package fixes more than 1,000 flaws across its products, including other vulnerabilities that could allow malicious code to run.
Windows users should also go to Settings, open Windows Update and search for available patches, restarting the device if requested.
However, that step should be carried out alongside the Office update check, not used as a substitute for it.
The Outlook vulnerability is identified as CVE-2026-124194, the reference number IT teams can use to locate the correct advisory and security fix.
