How to Fix CVE-2026-124194 in Microsoft 365 Apps

The two-minute check

1. Open any Office app you use for documents or spreadsheets.
2. Click File, then Account.
3. Look at the product name and version listed on that screen.
4. Compare it against Microsoft 365 Apps, Office 2021, Office 2024, or Office Online Server.

When you can stop reading

The official record only names Microsoft 365 Apps, Office 2021, Office 2024, Office Online Server, and Office generally as affected. If none of those run on any computer, phone or server in your business, this item doesn't apply to you. You can close this tab and get back to work.

What the official record says

The main flaw carries a Common Vulnerability Scoring System (CVSS) score of 6.5, rated MEDIUM (National Vulnerability Database (NVD)). The scoring details say an attacker can reach it over a network without needing a login. It only works if someone on your team takes an action first, like opening a file or clicking through a warning. If that happens, the flaw can expose sensitive information. It does not, based on the scoring, let an attacker change data or shut systems down on its own.

This flaw is on the Known Exploited Vulnerabilities (KEV) catalog, which means criminals are already using it in the real world (CISA KEV catalog). Federal agencies have a due date of November 24, 2026 to have it patched.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation at 1.6%, in the 76th percentile compared to other vulnerabilities (EPSS). That is a low chance of exploitation in the next 30 days, and it is a forecast, not a measure of how damaging the flaw could be.

The same update also fixes 25 related flaws in the same package. These include ones listed as CVE-2026-118711 and CVE-2026-118710. The record doesn't rate their severity individually. Installing the one update closes all of them at once.

What that means for a business like yours

Someone on your team has to open a file or click something for this to work. That is a normal part of running a business, since Office files move through email and shared drives every day. If it succeeds, an attacker can read information they shouldn't see. The scoring doesn't show it changing files or shutting systems down. The real takeaway is simple: criminals have already found this door, so closing it is routine maintenance, not an emergency overhaul.

If someone else manages your IT

Send your provider something like this:

"Please confirm our Office installs are patched for CVE-2026-124194. This update also covers 25 related fixes released at the same time. Let me know once every device is updated."

If you manage it yourself

1. Open any Office app on the computer.
2. Click File, then Account.
3. Click Update Options.
4. Click Update Now.
5. Wait for the download and install to finish.
6. Restart the app when it asks you to.
7. Repeat these steps on every computer that runs Office.

The record doesn't list a specific fixed version number. Check the vendor's advisory for the current version (Microsoft Security Response Center).

The answer is now. This flaw is already on the CISA Known Exploited Vulnerabilities catalog, with a federal due date of November 24, 2026. That deadline is set for federal agencies, not private businesses, but it's a useful one to borrow. Waiting past it adds risk for no good reason.

Open the Office app again. Click File, then Account. Click Update Options, then Update Now or View Updates. If no update shows as pending, the patch installed. You can also compare the build number on that screen against the one named in the vendor advisory.

A few steps lower the risk without removing it. Avoid opening Office files from senders you don't recognize. Turn on Protected View if it isn't already active, since it opens risky files in a restricted mode first. Ask whoever manages your systems to restrict macros from running automatically. None of these replace the update. They buy time, not immunity.

If you don't have someone watching for advisories like this one, a managed IT services provider can handle patching on a schedule instead of leaving it to chance. If Office is already part of a wider Microsoft 365 managed services plan, this kind of update should already be flagged and tracked for you.

Do I have to do anything if we only use this at home?

Yes. The flaw doesn't care whether the computer is in an office or a home. If Office or Microsoft 365 Apps is installed, the same update applies.

Will this break anything?

Vendor updates like this one are routine and generally don't change how your documents or spreadsheets look or work. Keep a backup of important files before any update, as a general habit, not because this one is risky.

How do I know if an attacker already used this against us?

The record doesn't describe specific signs of compromise. If you're worried about past activity, a cybersecurity review can check your systems for unusual activity.

Do I need to patch every computer, or just one?

Every computer, phone or server running the affected Office products needs the update. Missing even one leaves a door open.

We handle sensitive client data. Does this change our compliance obligations?

If you handle health records or financial data, unpatched software can factor into your HIPAA or FTC Safeguards Rule obligations. Patching promptly is one part of showing reasonable security, alongside controls like privileged access management.

If you want help confirming every device in your business is covered, request a free IT assessment or contact LayerLogix. LayerLogix brings 20+ years of experience and 100% U.S.-based support to businesses working through exactly this kind of update.