Microsoft's November security updates address an Outlook vulnerability that has already been exploited. In its November 11 alert, NHS England identifies CVE-2026-124194 as an Outlook spoofing flaw and says it has also been added to the US government's Known Exploited Vulnerabilities catalog.

This is a reason to check that your Office installation is receiving its applicable security updates, rather than postponing them indefinitely. If your workplace manages Office updates, ask your IT team whether the relevant fix has been deployed.

The NHS England security alert recommends applying the relevant updates as soon as possible and links to Microsoft's release guidance.