🔍 Read the full analysis: The Outlook Zero-Day Is Under Attack—Here’s What To Patch Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. Microsoft has released fixes; CISA set a November 24 deadline for US federal civilian agencies, while other organizations are urged to prioritize the update.
Microsoft says attackers are actively exploiting CVE-2026-124194, a vulnerability in Outlook that can disclose a user’s NTLMv2 authentication hash when the user opens a specially crafted file. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10 and set a November 24 patch deadline for federal civilian agencies; Microsoft has released updates for affected Office products.
Microsoft describes the issue as a spoofing vulnerability that can make Outlook connect to a network location controlled by an attacker without showing its usual external-content warning. The disclosed NTLMv2 hash is a protected form of a user’s login credential. Microsoft says an attacker could use it to authenticate as the user. The company rates the flaw Moderate, with a CVSS score of 6.5 out of 10.
The attack requires a person to open a malicious Office file, according to Microsoft. The company says the Preview Pane is not an attack vector, and says no account or prior privileges on the victim’s system are required. The vulnerability does not itself provide code execution, but exposed credentials could create further risk in an organization. Microsoft and CISA classify it as a failure to warn users about a potentially unsafe action.
Microsoft lists Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions, among the affected products. Its entry lists no workaround or mitigation: the security update is the fix. For Office LTSC 2021, Microsoft names build 16.0.14334.21048; for Office LTSC 2024, it names build 16.0.17932.21140. Microsoft 365 Apps received fixes through November 10 releases across its update channels; administrators should match installed builds to Microsoft’s channel-specific release information.
The Outlook Zero-Day Is Under Attack Patch Now
Microsoft says attackers are exploiting an Outlook flaw that can expose login credentials when a user opens a crafted file. Microsoft has released fixes.
How the exposure happens
The attack requires a person to open a specially crafted Office file in affected Outlook.
A user opens a malicious Office file.
It can connect to an attacker-controlled network location without its usual warning.
The user’s NTLMv2 hash may be exposed and could be used to authenticate as that user.
What to patch
Apply Microsoft’s security update or a later fixed build for the affected product.
| Product | Fixed release |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | November 10 release; build varies by channel |
Who needs to act
- Meet CISA’s November 24, 2026 deadline.
- Check installed Office builds against Microsoft’s guidance.
- CISA urges prioritizing this KEV-listed flaw.
- Match Microsoft 365 Apps builds to the correct update channel.
What the guidance says
A file must be opened
Microsoft says the Preview Pane is not an attack vector.
No workaround listed
Microsoft’s security update is the fix.
Impact scope is unclear
The available information does not identify victims or confirm that exposed hashes were used to access other systems.
Why Outlook Credential Exposure Matters
The vulnerability links a seemingly ordinary action—opening a file—to the possible exposure of credentials that may be used to authenticate within a workplace network. That makes the issue relevant beyond the individual Outlook user, particularly for organizations that rely on NTLM authentication. Credential exposure is not the same as confirmed account compromise, and the source material does not establish that attackers used stolen hashes to access other systems. Still, Microsoft says the exposed hash could be used for authentication, making prompt patching a practical risk-reduction step.
The incident also shows why severity scores are only one part of patch decisions. Microsoft rates this flaw Moderate, but marks exploitation as detected, and CISA says it has evidence of active exploitation. CISA’s catalog sets a binding remediation date for covered federal agencies and advises other organizations to prioritize listed vulnerabilities through risk-based patch management. For IT teams, checking actual Office build numbers is more useful than relying only on whether an update policy is enabled.
Products Worth Considering
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
As an affiliate, we earn on qualifying purchases.
How CISA Set the Patch Deadline
On November 10, CISA added six vulnerabilities to its KEV catalog, citing evidence of active exploitation. The Outlook issue appears under the name “Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability.” CISA’s entry calls for applying vendor instructions and says agencies should discontinue use of a product if mitigations are unavailable. Microsoft has supplied an update for this flaw.
The November 24 deadline applies to US Federal Civilian Executive Branch agencies under CISA’s Binding Operational Directive 26-04; it is not a general legal deadline for private companies or individuals. CISA nevertheless encourages all organizations to prioritize KEV-listed flaws. Its record lists ransomware use as unknown and does not mark this flaw for forensic triage under the directive. Those fields do not establish that ransomware is involved or that no compromise has occurred.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 security guidance
What Is Not Yet Known About Attacks
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists ransomware use as unknown. There is also no reported count of compromised accounts or confirmation that exposed hashes were successfully used to access other systems.
Microsoft’s stated attack conditions require a user to open a crafted file, while its guidance says the Preview Pane is not an attack vector. CISA’s NVD risk fields characterize exploitation as active, automatable as no, and technical impact as partial. Any interpretation that this means attacks are targeted rather than widespread is an inference, not a confirmed description of the campaign. The evidence provided does not establish the scale or methods of specific incidents.
Check Office Builds Before November 24
Organizations should identify their Outlook and Office versions, then compare installed build numbers with Microsoft’s security guidance for the relevant product and Microsoft 365 update channel. Apply the November 10 security release or a later fixed build. For Office LTSC, the listed fixed builds are 16.0.14334.21048 for 2021 and 16.0.17932.21140 for 2024. Microsoft 365 Apps builds vary by channel, so administrators should consult the channel-specific release list rather than assume one version applies to every installation.
Federal civilian agencies must meet CISA’s November 24, 2026 deadline. Other organizations have no deadline imposed by this directive, but CISA urges them to prioritize the vulnerability. Microsoft and CISA may provide further technical or incident information; until then, the available sources do not say whether the attacks have stopped or how many victims are involved.
Key Questions
What does Outlook vulnerability CVE-2026-124194 do?
Microsoft says opening a specially crafted file in an affected version of Outlook can make the program connect to an attacker-controlled network location without the usual warning. That connection can disclose the user’s NTLMv2 hash, which Microsoft says could be used to authenticate as the user.
Does the Outlook Preview Pane trigger the attack?
No. Microsoft says the Preview Pane is not an attack vector. Its description says the user must be convinced to open a malicious Office file.
Which Office updates fix the vulnerability?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140. Microsoft 365 Apps fixes are included in November 10 releases, with build numbers varying by update channel. Check Microsoft’s release information for the applicable channel.
Who must patch by November 24, 2026?
The deadline applies to US Federal Civilian Executive Branch agencies under CISA’s directive. CISA encourages other organizations to prioritize the flaw, but the directive’s date is not a binding deadline for them.
Is there evidence of ransomware or confirmed account theft?
The provided CISA entry lists ransomware use as unknown. The source material does not confirm account theft, successful use of stolen hashes, the number of affected victims, or the identity of the attackers.
Source: ThorstenMeyerAI.com
