Attackers are already using a flaw in Outlook. Microsoft’s fix is out now.

Microsoft’s November security updates, released on Tuesday evening UK time, fix an Outlook zero-day: a flaw in the classic Outlook app for Windows that attackers were already using before the fix existed. If your business runs Outlook on Windows PCs, make sure this month’s update is on every machine this week.

What the flaw does

An attacker sends a specially made message file, typically as an attachment. When someone opens it, Outlook quietly connects to a server the attacker controls and hands over a scrambled copy of that person’s Windows sign-in, known as an NTLM hash. Microsoft says simply seeing the message in the preview pane isn’t enough. The file has to be opened.

That scrambled sign-in is more useful to a criminal than it sounds. Weak passwords can be cracked from it, and on many office networks it can be replayed to get into file shares and other systems as that person, without ever knowing the password.

Why it matters to your business

Opening an attachment that looks like an invoice or a voicemail is a normal part of most people’s day. That is exactly why attackers like flaws like this one. Training helps people spot the obvious fakes. The update removes this particular trick altogether.

Your team can’t be expected to spot every bad attachment. Keeping Outlook up to date means one wrong click doesn’t hand over a password.

Ashley Adkins, fromIT

How to check you’re covered

Microsoft 365 apps usually update themselves within a few days, but you don’t have to wait. In Outlook, go to File, then Office Account, then Update Options, and choose Update Now. Windows Update covers the rest of this month’s fixes, including several critical ones in Windows itself, so restart any PC that’s been asking to. If someone looks after your IT, ask them to confirm the November updates are on every device, and that includes laptops that are only in the office now and then.

A record month

This month’s release fixes more than 1,000 flaws across Microsoft’s products, with over 60 rated critical. Counts differ between security firms, and BleepingComputer calls it a record. It fits a pattern we wrote about recently: AI tools are helping researchers find bugs much faster, so updates are getting bigger and leaving them a week or two late is getting riskier. Turning on automatic updates and checking they actually happen is now one of the most useful things a business can do.

Sources

• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day (10 November 2026)
• Tenable: Microsoft's November 2026 Patch Tuesday (10 November 2026)
• Redmondmag: Microsoft November Patch Tuesday fixes more than 1,000 flaws (10 November 2026)