Exploited in the wildMEDIUMCISA KEV

Exploited Outlook zero-day leaks users' NTLMv2 hashes when crafted files are opened

Opening a crafted file makes classic Outlook connect to an attacker's server without warning, which exposes the user's NTLMv2 hash. Microsoft reports in-the-wild exploitation. Patch Office before CISA's KEV deadline of 2026-11-24.

Microsoft Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024)CVE-2026-124194CVSS6.5CWE-356Email
Published Nov 11, 2026

Microsoft rates the flaw 'Exploitation Detected' and it was fixed as a zero-day. CISA added it to KEV on 2026-11-10. Microsoft has not disclosed actors, a start date or post-exploitation details, and no IOCs have been published 6,2,7.

Nov 10, 202614 daysNov 24, 2026

What you need to know

  • Exposure: classic Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Sources do not address new Outlook for Windows or Outlook on the web.
  • Impact: opening a crafted file leaks the user's NTLMv2 hash. Attackers can relay it or crack it offline. There is no code execution, and the Preview Pane is not a vector.
  • Exploitation: Microsoft reports in-the-wild use as a zero-day. CISA added it to KEV on 2026-11-10 with a 2026-11-24 due date. No actors, timeline or IOCs are public.
  • Fix: LTSC 2021 16.0.14334.21048 and LTSC 2024 16.0.17932.21140. For Microsoft 365 Apps, use the builds in the Office security release notes. Sources document no workaround besides patching.
  • Detect: hunt for OUTLOOK.EXE making outbound SMB connections to external hosts, and for NTLM network logons from unexpected sources for affected users.

What's happening

CVE-2026-124194 is an Outlook spoofing flaw. The CVE record classifies it as CWE-356, a product UI that does not warn users of unsafe actions 1. In practice it is a credential leak. Microsoft's description says opening a crafted message file makes Outlook connect to an attacker-controlled network location without the usual external-content warning 4. That connection exposes authentication data that can be used to impersonate the user 4. SecurityWeek reports that Microsoft's advisory identifies this data as the user's NTLMv2 hash 5. The CVSS 3.1 base score is 6.5 1.

The CVE record lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in both 32-bit and x64 builds 1. Rapid7 says all supported versions of classic Outlook receive the fix 6. None of the sources say whether new Outlook for Windows or Outlook on the web is affected.

Microsoft marks the bug as exploited and not publicly disclosed before the fix. It was the only exploited flaw in the November 2026 release 6,5. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-10 "based on evidence of active exploitation" and set a federal due date of 2026-11-24 2,3. Microsoft has not said when attacks began, who is behind them or what attackers did after exploitation 7. CISA lists ransomware use as unknown 3.

How it works

The root cause is a missing safety prompt. Outlook does not alert the user before a potentially dangerous action, here an outbound connection to a remote location 5,1. When the victim opens the malicious item, Windows connects to an attacker-controlled network share. It may then attempt authentication automatically, which exposes the NTLMv2 hash 8. Microsoft's wording describes the lure as a crafted message file 4, while Tenable describes it as a crafted Office file 9.

No authentication is required. The victim must open the crafted file, and the victim's machine must be able to reach the attacker's network location 7. Microsoft states that the Preview Pane is not an attack vector 5. Rapid7 says this limits real-world impact somewhat 6. The impact is confidentiality only, and the bug does not give code execution on its own 9.

The value of the stolen hash depends on the environment. It can be relayed live only to services that lack safeguards such as SMB or LDAP signing, or Extended Protection for Authentication on Exchange and AD CS 6. Otherwise, attackers can try to crack it offline 6. Rapid7 assesses that the 6.5 score understates the risk because the bug suits both large-scale initial-access harvesting and targeted campaigns 6. ZDI's Dustin Childs likewise says the impact is larger than the spoofing label suggests 10.

What to do

In order of priority
  1. 1

    Install Microsoft's 2026-11-10 security update for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Confirm that clients reach the fixed builds listed in the affected table 1. CISA requires federal agencies to remediate by 2026-11-24 3.

  2. 2

    Treat the update as the only fix. None of the sources document a vendor workaround other than patching.

  3. 3

    Reduce the value of any leaked hash by enforcing SMB signing, LDAP signing and Extended Protection for Authentication on Exchange and AD CS. These controls limit relay but do not stop the hash from being disclosed 6.

  4. 4

    Restrict outbound SMB (TCP 445) from user networks to the internet at the perimeter. This is general hardening practice. The sources do not tie it specifically to this CVE.

  5. 5

    As a precaution, consider resetting passwords for users who opened unsolicited message files before patching, starting with privileged accounts. Rapid7 notes that captured NTLMv2 hashes can be cracked offline 6.

  6. 6

    Review authentication logs for those users for NTLM logons from unexpected hosts. Such logons could indicate a relayed hash 6.

Detection

  • Validate exposure with your software inventory or EDR. Compare installed Office builds against the fixed versions: LTSC 2021 16.0.14334.21048 and LTSC 2024 16.0.17932.21140. For Microsoft 365 Apps, compare against the per-channel builds in Microsoft's Office security release notes 1.
  • Microsoft has not published IOCs or post-exploitation details 7. The hunts below are behavioural and are not taken from a vendor detection guide.
  • In EDR network telemetry, look for OUTLOOK.EXE, or the WebClient service acting on its behalf, opening outbound SMB (TCP 445) or WebDAV connections to internet addresses. The vulnerable behaviour is a connection to an attacker-controlled share 8.
  • Review firewall and proxy egress logs for workstation connections to external hosts on TCP 445. Extend the review back before 2026-11-10, because exploitation predates the patch 6.
  • Where outgoing NTLM auditing is enabled, check Microsoft-Windows-NTLM/Operational event 8001 for NTLM authentication to servers outside your domain.
  • Hunt for relay or reuse of captured hashes. Look for Windows event 4624 (Logon Type 3, NTLM) from unusual source hosts, and for NTLM authentication to Exchange, AD CS or LDAP from unexpected IPs. These are the services Rapid7 names as relay targets when protections are missing 6.
  • On the mail gateway, search for inbound message-file attachments (for example .msg or .eml) from external senders. Microsoft describes the lure as a crafted message file 4.

Timeline

  1. Microsoft releases the November 2026 Patch Tuesday fix and the CVE record. It flags the bug as exploited and not publicly disclosed. 6

  2. CISA adds CVE-2026-124194 to the Known Exploited Vulnerabilities catalog. 2

  3. CISA KEV remediation due date for federal civilian agencies. 3

Sources

  1. 1
    CVE Record: CVE-2026-124194 (CNA: Microsoft)
    CVE Program / Microsoft CNA · Vendor · Nov 10, 2026
  2. 2
    CISA Adds Six Known Exploited Vulnerabilities to Catalog
    CISA · Government · Nov 10, 2026
  3. 3
    CISA KEV entry for CVE-2026-124194
    CISA · Government · Nov 10, 2026
  4. 4
    Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row
    The Record · News · Nov 10, 2026
  5. 5
    Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
    SecurityWeek · News · Nov 10, 2026
  6. 6
    Patch Tuesday - November 2026
    Rapid7 · Research · Nov 10, 2026
  7. 7
    Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
    The Hacker News · News · Nov 10, 2026
  8. 8
    Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
    BleepingComputer · News · Nov 10, 2026
  9. 9
    Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)
    Tenable · Research · Nov 10, 2026
  10. 10
    November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
    The Register · News · Nov 10, 2026

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 10 sources, then checked against them by a separate review step on Nov 11, 2026.

Microsoft's advisory page could not be read directly. Its 'Exploitation Detected' rating and NTLMv2 wording are reported here via Rapid7, SecurityWeek and The Record.

Microsoft has not disclosed attackers, a start date, scale or IOCs. The detection guidance is behavioural and is not vendor-supplied.

No public proof-of-concept was confirmed. Microsoft rates the flaw as not publicly disclosed before the fix.

Sources differ on the lure: Microsoft's wording says a crafted 'message file', while Tenable says a crafted 'Office file'.

Per-channel fixed builds for Microsoft 365 Apps appear only in Microsoft's Office security release notes, not in the CVE record.

The Record reports an end-of-month CISA deadline. The KEV catalog gives 2026-11-24, which this brief uses.

Spotted an error? Open an issue on sochub.io.