🔍 Read the full analysis: What’s On The Patch List For The Outlook Zero-Day? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash after the user opens a crafted file. Microsoft has released updates and lists no workaround; US federal civilian agencies have a November 24, 2026, remediation deadline. The attackers, targets and duration of exploitation have not been identified in the source material.
Microsoft says attackers are actively exploiting Outlook vulnerability CVE-2026-124194, a flaw that can expose a user’s NTLMv2 authentication hash when the user opens a specially crafted file, amid a widening patch gap. Microsoft has released software updates and lists no workaround; the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, giving US federal civilian agencies until November 24, 2026, to address it.
Microsoft classifies CVE-2026-124194 as a Moderate-severity Outlook spoofing vulnerability, with a CVSS score of 6.5 out of 10. Its description says an unauthenticated attacker can send a specially crafted Office file and persuade a user to open it. Outlook may then connect to an attacker-controlled network location without showing the usual external-content warning, exposing the user’s NTLMv2 hash. Microsoft says an attacker could use that hash to authenticate as the user.
The attack requires a user to open the malicious file; Microsoft says the Preview Pane is not an attack vector. The source material says the flaw does not permit code execution. Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions, as affected. It lists fixed builds of 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024.
For Microsoft 365 Apps, the source material identifies November 10 security builds including Current Channel Version 2610, build 20527.20196; Monthly Enterprise Channel Version 2610, build 20527.20194; Version 2609, build 20430.20264; and Version 2608, build 20326.20320. It also gives Semi-Annual Enterprise Channel Version 2610, build 20527.20192, and Version 2609, build 20430, but the supplied text cuts off before giving the complete build number. Administrators should check Microsoft’s release information for the applicable channel and full fixed build before confirming deployment.
What’s on the Outlook patch list? CVE-2026-124194
Microsoft reports active exploitation of an Outlook flaw that can expose a user’s NTLMv2 hash when they open a crafted Office file. Updates are available, and Microsoft lists no workaround.
What the flaw can expose
The attack requires a user to open a specially crafted file; Microsoft says the Preview Pane is not an attack vector.
An attacker must persuade a user to open a malicious Office file in affected Outlook.
It may connect to an attacker-controlled network location without the usual external-content warning.
Microsoft says the captured NTLMv2 hash could be used to authenticate as the user. The flaw is not described as enabling code execution.
Affected products and fixes
Check the installed Office build against Microsoft’s release information for the applicable channel.
| Product | Fixed build information in source | Admin action |
|---|---|---|
| Office LTSC 2021 | 16.0.14334.21048 | Verify installed build and update |
| Office LTSC 2024 | 16.0.17932.21140 | Verify installed build and update |
| Microsoft 365 Apps | November 10 security builds listed for several channels; Semi-Annual Enterprise Version 2609 build is incomplete in the source | Confirm the full applicable build in Microsoft’s release information |
What organizations should do
Active exploitation makes this an immediate patching issue, while the federal deadline applies specifically to US federal civilian agencies.
Why the Hash Exposure Matters
The flaw is not described as a route to immediate code execution, but a captured NTLMv2 hash can create a path to account impersonation, according to Microsoft. That makes the issue relevant to organizations where Outlook users have access to internal systems: a compromised identity could put additional accounts or resources at risk, depending on the attacker’s access and the organization’s defenses. The source does not establish that any particular follow-on activity has occurred.
CISA’s catalog listing makes the issue a priority for US federal civilian agencies, which must act by November 24 under the applicable directive. That requirement does not apply to every business or individual. CISA encourages other organizations to prioritize catalog vulnerabilities using risk-based vulnerability management, making the federal deadline a useful signal of urgency rather than a binding deadline for them.
The exploitation status also changes the practical response. This is not only a flaw to track for a future patch cycle: Microsoft and CISA identify it as under active exploitation, and Microsoft says the update is the fix. Organizations should verify the installed Office build rather than assume updates have already reached every device.
Popular right now
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
Shark WANDVAC Power PET Cordless Handheld Vacuum, White, WV410WH
eufy C28 Robot Vacuum and Mop for Pet Hair, 15,000 Pa
As an affiliate, we earn on qualifying purchases.
From Moderate Rating to Active Exploitation
Microsoft names the issue the Microsoft Outlook Spoofing Vulnerability and rates it Moderate. The source material reports a CVSS score of 6.5 and says the vulnerability requires a user to open a crafted file. Those details describe the conditions and potential impact; they do not change Microsoft’s and CISA’s separate assessment that attackers are exploiting the flaw.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10, 2026, as part of an alert covering six vulnerabilities in products from Microsoft, Cisco, Barracuda Networks, Openwave and Google Chromium. CISA said the additions were based on evidence of active exploitation. The Outlook entry names a November 24 due date and directs agencies to apply mitigations according to vendor instructions, or discontinue product use if mitigations are unavailable. Microsoft has released updates for the affected Office products.
The source says Microsoft marked this as the only flaw in its November release with “Exploitation Detected.” It also reports that the CISA entry lists ransomware use as unknown and does not mark the flaw for forensic triage. Those catalog fields do not establish whether an organization has been compromised; they describe the information and actions recorded in the entry.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 description
What Is Not Yet Known
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. It also does not establish whether the flaw has been used in ransomware campaigns; CISA’s catalog field for that activity is listed as unknown.
The source does not provide a complete list of fixed Microsoft 365 Apps builds: its Semi-Annual Enterprise Channel details end partway through the Version 2609 entry. Nor does the source quantify successful account compromises or describe what attackers did after obtaining a hash. Active exploitation is reported, but that status alone does not show that every affected organization has been targeted or breached.
Verify Office Builds Before the Deadline
IT teams should identify affected Office installations, check their installed build numbers against Microsoft’s security release information, and deploy the applicable update. The source lists no workaround, so the Microsoft update is the stated fix. Because the supplied Semi-Annual Enterprise Channel information is incomplete, administrators should confirm the full build details directly in Microsoft’s current release documentation rather than infer a missing number.
US federal civilian agencies must meet CISA’s November 24, 2026, deadline. Other organizations are not covered by that directive, but CISA advises them to prioritize KEV catalog vulnerabilities according to risk. The source material does not give a later investigation update or another scheduled milestone; the immediate next step is to apply the relevant Office update and check for further guidance from Microsoft and CISA.
Key Questions
What does the Outlook vulnerability do?
Microsoft says a specially crafted Office file, once opened in affected Outlook versions, can prompt a connection to an attacker-controlled network location without the usual warning. That can expose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
Does the attack work through Outlook’s Preview Pane?
No. According to the source material, Microsoft says the Preview Pane is not an attack vector. The described attack requires the user to open the crafted file.
Which Office versions and builds should organizations check?
The source lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit editions, as affected. Fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps builds vary by update channel, so administrators should check Microsoft’s release information for the complete applicable build.
Who must meet the November 24 deadline?
CISA’s directive applies to US federal civilian executive branch agencies. CISA encourages other organizations to prioritize vulnerabilities in its KEV catalog, but the supplied source says the fixed-date requirement does not apply to them.
Is a workaround available, and who is being targeted?
The source says Microsoft lists no workaround and identifies the update as the fix. It does not identify the attackers, targets, number of affected users, or the start date of exploitation.
Source: ThorstenMeyerAI.com
