🔍 Read the full analysis: Patch The Outlook Zero-Day: What Organizations Should Do Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. Microsoft lists no workaround; organizations should update affected Office installations, while U.S. federal civilian agencies face a November 24, 2026, remediation deadline.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash after the user opens a specially crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, and Microsoft says the November 10 Office updates are the fix; U.S. federal civilian agencies must apply the required mitigation by November 24.
Microsoft describes the issue as an unauthenticated attacker sending a malicious Office file and persuading a user to open it in an affected version of Outlook. The flaw can cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. That connection may disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as that user. The source material does not say that the vulnerability allows code execution.
The attack requires a user to open the file, according to Microsoft; simply viewing it in Outlook’s Preview Pane is not an attack vector, the company says. Microsoft rates the vulnerability “Moderate” and gives it a CVSS score of 6.5 out of 10. It is identified as CVE-2026-124194, also named the Microsoft Outlook Spoofing Vulnerability.
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected, including 32-bit and 64-bit editions. Its listed fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps users should install the November 10 security update for their update channel and verify the installed build against Microsoft’s release information. The source material does not provide the complete list of Microsoft 365 Apps channel builds, so administrators should consult Microsoft’s current update guidance for their deployment.
Patch the Outlook zero-day What organizations should do now
Microsoft says attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Apply the November 10 Office update and verify the installed build.
How the flaw works
A user must open a specially crafted file in affected Outlook; the Preview Pane is not an attack vector.
The attacker persuades a user to open it in an affected Outlook version.
It can connect to an attacker-controlled location without the usual warning.
The NTLMv2 hash could potentially be used to authenticate as that user.
Who is affected
Microsoft lists these Office products as affected.
Patch and verify
Microsoft lists no workaround. Check installed builds against its release guidance.
Deadline depends on your organization
- Must apply the required mitigation by November 24, 2026.
- The deadline is under CISA’s directive.
- CISA encourages prioritizing KEV vulnerabilities.
- The cited directive does not impose its deadline on other organizations.
Why Stolen Outlook Credentials Matter
The risk is not limited to a misleading message or a missing warning. A disclosed NTLMv2 hash can potentially be used to authenticate as the user, according to Microsoft’s description. If an account is used inside an organization, exposure could create a path to further access; the extent of that risk depends on the account and the organization’s environment. The source material does not establish that attackers have used stolen hashes to access particular networks.
The combination of active exploitation and an available software update makes patching a priority even though Microsoft rates the flaw Moderate and user action is required. The CISA deadline formally applies to federal civilian executive-branch agencies, not every business or organization. For others, CISA’s catalog is a signal to prioritize remediation, not a binding deadline.
Products Worth Considering
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Apple Watch SE 3 GPS 44mm Smartwatch
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
As an affiliate, we earn on qualifying purchases.
From Microsoft Alert to CISA Deadline
Microsoft’s security entry says exploitation has been detected and provides the affected products and update information. On November 10, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, saying the additions were based on evidence of active exploitation. The same day’s catalog update also included flaws in products from other vendors.
CISA’s catalog sets a November 24, 2026, due date for this entry under Binding Operational Directive 26-04. CISA says that directive applies only to federal civilian executive-branch agencies. The catalog’s required action is to apply mitigations according to vendor instructions, or discontinue use if mitigations are unavailable. Microsoft has released updates for the affected Office products and lists no workaround or separate mitigation for this vulnerability.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its security entry for CVE-2026-124194
Attack Scope Remains Undisclosed
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may be affected, or when exploitation began. It also does not establish whether the disclosed hashes have been used to access accounts or networks. CISA’s catalog lists use in ransomware campaigns as “Unknown,” which is not evidence either that ransomware is involved or that it is not.
Microsoft and CISA identify the flaw as actively exploited, but the information provided does not give details of observed incidents or the methods attackers used to deliver the files. CISA’s entry is not marked for forensic triage under the directive, according to the source material; that designation does not determine whether a particular organization has been compromised. Organizations should treat patching and incident investigation as separate questions: installing the update addresses the vulnerability but does not by itself establish whether an account was previously exposed.
Verify Office Builds Before November 24
Organizations should identify whether they run an affected Outlook and Office version, deploy the applicable November 10 update, and verify the installed build rather than relying only on update policies or deployment status. Administrators should check Microsoft’s release guidance for the correct Microsoft 365 Apps channel and confirm that Office LTSC installations meet the fixed-build numbers listed by Microsoft.
Federal civilian agencies must meet CISA’s November 24, 2026, deadline under the directive. Other organizations are encouraged by CISA to prioritize the KEV entry according to their risk-management processes. The source material gives no later milestone for Microsoft or CISA, so the next immediate step for organizations is to confirm deployment and assess whether any security review is warranted.
Key Questions
What does CVE-2026-124194 do?
Microsoft says opening a specially crafted file in affected Outlook versions can cause Outlook to connect to an attacker-controlled location without the usual warning and disclose the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its description says a user must be persuaded to open the malicious file.
What should organizations install?
Microsoft lists the November 10 Office update as the fix and says there is no workaround. Administrators should install the update for their affected product and Microsoft 365 Apps channel, then verify the installed build against Microsoft’s guidance.
Who must meet the November 24 deadline?
The deadline applies to U.S. federal civilian executive-branch agencies under CISA’s directive. CISA encourages other organizations to prioritize vulnerabilities in its KEV catalog, but the cited directive does not impose that date on them.
Do officials know who was attacked or whether ransomware is involved?
The source material does not identify the attackers, targets, number of affected organizations, or start date of exploitation. CISA lists ransomware use as Unknown.
Source: ThorstenMeyerAI.com
