Boise Businesses: Patch This Outlook Flaw This Week
The short version
Microsoft's November 10 security update fixed a flaw in classic Outlook for Windows, CVE-2026-124194, that attackers were already using. CISA added it to its list of actively exploited flaws the same day.
If someone opens a booby-trapped file, Outlook can quietly connect to the attacker's server and hand over a scrambled copy of that person's Windows login, called an NTLMv2 hash. Attackers can try to crack it or reuse it to get into other systems.
Why Treasure Valley offices should care
Most offices we work with across Boise, Meridian and Nampa still run the classic Outlook app on Windows. That includes medical and dental practices, financial offices and nonprofits. For businesses that handle patient or financial data, one stolen login can turn into a reportable incident. The fix takes about 10 minutes per PC.
Your checklist for this week
- Update Office on every Windows PC: File > Office Account > Update Options > Update Now.
- Restart each PC after the update.
- Tell your team not to open attachments they weren't expecting, even from people they know.
- Ask your IT provider if outbound SMB traffic is blocked at your firewall.
- Update Chrome too. Google fixed a separate exploited Chrome flaw on November 9.
Need a hand?
Idacomp is Boise's managed IT and cybersecurity team, part of the Bytagig family. If you're not sure every machine in your office got the update, we'll check with you. Book a discovery call or call (208) 314-1181.










