SECURITYHIGHCVE-2026-124194

CVE-2026-124194: Outlook Spoofing Zero-Day Leaks NTLM Hashes (Exploited)

Microsoft patched an actively exploited Outlook flaw that connects to attacker servers without warning and can leak NTLMv2 hashes. CISA KEV deadline: Nov 24.

Dylan H.

Security Team

November 11, 2026
2 min read
CVE-2026-124194: Outlook Spoofing Zero-Day Leaks NTLM Hashes (Exploited)

Actively exploited

Reported as exploited in the wild (e.g. CISA KEV). Patch or mitigate immediately.

Affected Products

  • Microsoft 365 Apps for Enterprise
  • Microsoft Office LTSC 2021
  • Microsoft Office LTSC 2024

Overview

CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook ("missing user interaction for potentially unsafe action") that Microsoft fixed in its November 10, 2026 Patch Tuesday release. Microsoft marks it as exploited in the wild, and it is the only actively exploited zero-day in that release. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on November 10.

Microsoft rates it Moderate (CVSS 6.5), but because it is under active exploitation and enables credential theft, we treat it as high priority.

How It Works

  • An attacker sends a crafted message file and persuades the victim to open it.
  • Outlook then connects to an attacker-controlled server without showing the usual external-content warning.
  • That outbound connection can leak the user's NTLMv2 hash, which can be cracked offline or relayed to other services.
  • The Preview Pane does not trigger the flaw; the message has to be opened.

Microsoft's advisory gives no detail on the scale or geography of the attacks. Per press reports, the flaw was reported by a researcher who used Anthropic's Claude during discovery.

Affected Products

ProductStatus
Microsoft 365 Apps for EnterpriseAffected
Office LTSC 2021Affected
Office LTSC 2024Affected

Remediation

  1. Update Office now. The fix ships through the Office updater, not Windows Update. In Outlook: File → Office Account → Update Options → Update Now.
  2. Meet the CISA deadline. Federal agencies must patch by November 24, 2026; private organizations should follow the same timeline.
  3. Block outbound SMB/NTLM to the internet. Egress-filter TCP 445 and 139 at the perimeter.
  4. Reduce NTLM exposure. Audit and restrict NTLM, and enable SMB signing and Extended Protection for Authentication where possible.
  5. Hunt. Look for Outlook processes making unexpected outbound connections, and for NTLM authentication attempts to external hosts after users opened message files.
  6. Rotate credentials for any user who opened a suspicious message file before patching.

Related Coverage

For the full month's release, see our November 2026 Patch Tuesday coverage.

References