🔍 Read the full analysis: Outlook Zero-Day: A Deadline-Driven Guide To What To Patch on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft and CISA say attackers are actively exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after the user opens a crafted file. U.S. federal civilian agencies have until Nov. 24, 2026, to apply the available Microsoft updates; CISA urges other organizations to prioritize remediation too.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash when the user opens a specially crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026, and U.S. federal civilian agencies must apply the available fix by Nov. 24.
Microsoft classifies CVE-2026-124194 as a moderate-severity Outlook spoofing vulnerability and gives it a CVSS score of 6.5 out of 10. The attack requires a user to open a malicious file in an affected version of Outlook. Microsoft says the file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing the user’s NTLMv2 hash.
Microsoft says an attacker could use the disclosed hash to authenticate as the user. The company describes the flaw as requiring no attacker privileges, but it does require the recipient to open the file. Microsoft says the Preview Pane is not an attack vector. The vulnerability does not, according to the supplied advisory details, give an attacker the ability to run code directly.
The affected products listed in the source are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit editions. Microsoft lists fixed builds including 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps fixes are delivered through channel-specific updates dated Nov. 10; administrators should verify the applicable channel and installed build against Microsoft’s release guidance. Microsoft lists no workaround, making the update the stated fix.
Outlook Zero-Day What to Patch, by When
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Microsoft has released updates; the deadline depends on your organization.
What the flaw can expose
A user must open a specially crafted file in an affected Outlook version.
The Preview Pane is not an attack vector.
The connection can happen without the usual external-content warning.
Microsoft says an attacker could use the NTLMv2 hash to authenticate as the user.
Who must act by the deadline?
CISA says exploitation is active and urges risk-based remediation.
- BOD 26-04 applies to these agencies.
- Apply the available Microsoft update by Nov. 24, 2026.
- The cited federal deadline does not apply.
- CISA recommends prioritizing KEV catalog vulnerabilities.
Products and fixes
Check each installation and match the update to its product and channel.
Verify the fixed build
Microsoft lists build 16.0.14334.21048.
Verify the fixed build
Microsoft lists build 16.0.17932.21140.
Check the channel
Nov. 10 updates are channel-specific; confirm the applicable build in Microsoft’s release guidance.
Why the Hash Exposure Matters
The immediate concern is not simply that Outlook can display a malicious file. The flaw can cause a connection to an attacker-controlled location without the expected warning, potentially exposing an authentication credential that may be useful beyond the affected message. Microsoft says the hash could be used to authenticate as the user, creating a risk for organizations where compromised credentials could provide access to internal systems.
The need for a person to open the file limits how the attack works, but does not remove the risk. It makes the vulnerability relevant to email security and user awareness as well as patch management. Microsoft rates it moderate, with a 6.5 CVSS score; its presence in CISA’s actively exploited catalog means organizations have reason to prioritize the fix rather than relying on the severity rating alone.
The Nov. 24 date is a binding remediation deadline for U.S. federal civilian executive branch agencies under the cited directive. It is not a universal legal deadline for private organizations. CISA nevertheless recommends that all organizations prioritize vulnerabilities in the KEV catalog using risk-based vulnerability management.
Products Worth Considering
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Deadline Was Set
CISA added the Outlook issue to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026, in an alert covering six vulnerabilities across products from Microsoft, Cisco, Barracuda Networks, Openwave and Google Chromium. CISA said the additions were based on evidence of active exploitation. The catalog entry gives federal civilian agencies a due date of Nov. 24 and directs them to apply vendor mitigations, or discontinue use of a product if mitigations are unavailable.
For this Outlook flaw, Microsoft has released updates. CISA’s directive, BOD 26-04, applies only to federal civilian executive branch agencies; the agency separately encourages other organizations to prioritize KEV-listed vulnerabilities. The source reports that Microsoft marked the flaw “Exploitation Detected” in its November release. While the issue requires a user to open a file, CISA’s risk fields classify exploitation as active and automatable as no.
“The attacker “could use this to authenticate as the user.””
— Microsoft, in its CVE-2026-124194 security entry
What the Exploitation Record Lacks
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists use in ransomware campaigns as unknown. The supplied material also says the flaw is not marked for forensic triage under the directive, which means the cited entry does not require agencies to conduct the additional compromise check specified for some vulnerabilities.
Those gaps do not establish that no compromise occurred. They mean the public information cited here does not answer the scale or operational history of the attacks. Organizations will need to rely on their own security monitoring and any further advisories from Microsoft or CISA for case-specific findings.
Verify Builds Before Nov. 24
Federal civilian IT teams should identify affected Outlook installations, confirm the installed Office build and apply the Microsoft update that matches each product and Microsoft 365 Apps channel. The source lists fixed LTSC builds, but channel-specific Microsoft 365 Apps build numbers vary; administrators should check Microsoft’s Nov. 10 release information for the correct version rather than assume a single build applies to every installation.
Agencies must meet CISA’s Nov. 24, 2026, deadline. Other organizations are not subject to that federal date under the cited directive, but CISA advises them to prioritize remediation. Further information about attackers, targets and the duration of exploitation may emerge in later Microsoft or government updates.
Key Questions
What does CVE-2026-124194 do?
Microsoft says opening a specially crafted file in an affected Outlook version can make the application connect to an attacker-controlled location without the usual warning. That connection can expose the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the crafted file.
Who has to meet the Nov. 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under CISA directive BOD 26-04. CISA recommends that other organizations prioritize the flaw, but the cited directive does not make the date mandatory for them.
Is there a workaround?
The source says Microsoft lists no workaround. Microsoft has released updates for affected Office products, and the update is the stated fix.
Are the attackers or affected organizations known?
The supplied information does not identify the attackers, targets, number of affected users or organizations, or when the exploitation began. CISA also lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
