November 11, 2026

Outlook Zero-Day Under Attack: What SMBs Should Do Now

What happened

On November 10, Microsoft released its monthly security updates. They fixed more than a thousand flaws. One matters most for small businesses: CVE-2026-124194, a flaw in classic Outlook that attackers were already using before the fix shipped.

The same day, CISA added it to its list of known exploited vulnerabilities. Federal agencies have until November 24 to patch.

The attack starts when someone opens a specially crafted file. Outlook then connects to a server the attacker controls, without its usual warning. That connection can give away the user’s NTLMv2 password hash, a scrambled copy of their Windows login. Attackers can try to crack it or reuse it to get into other systems.

Microsoft rates the flaw only Moderate. Don’t let that fool you. A modest flaw that attackers are actively using is more dangerous than a severe one nobody is using.

Who is affected

Any business that runs the classic Outlook desktop app on Windows and hasn’t installed the November update. That includes most clinics, credit unions, accounting firms and nonprofits. Microsoft says simply previewing a message is not the attack path. Someone has to open the file, which makes your staff the last line of defense.

For clinics and financial offices in Oregon and Idaho, one stolen login can turn into a reportable incident. A 10-minute update now costs far less.

What to do this week

Update Office on every PC. In Outlook or Word, go to File > Office Account > Update Options > Update Now. Include the PCs that rarely get used.
Restart. The update isn’t finished until Outlook closes and reopens. A full restart is better.
Brief your team today. Ask them not to open attachments they weren’t expecting, even from people they know. They should report anything odd instead of deleting it.
Ask your IT provider one question: “Do we block outbound SMB traffic to the internet?” That block helps stop this kind of login-hash leak.
Update Chrome too. On November 9, Google patched a separate Chrome flaw that attackers were already using. Chrome installs the fix when the browser restarts.

How Bytagig helps

Patch management is at the core of what we do. We roll updates out, then confirm every machine actually installed them. If no one checks that in your office, that’s the gap attackers count on.