🔍 Read the full analysis: What Comes First In Patching The Outlook Zero-Day? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. Microsoft has released updates, and CISA requires U.S. federal civilian agencies to apply mitigations by November 24, 2026; other organizations are urged to prioritize the fix.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 login hash when the user opens a crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10 and set a November 24 deadline for U.S. federal civilian agencies to apply mitigations; Microsoft has released updates, with no workaround listed.
Microsoft describes the issue as a spoofing vulnerability. An unauthenticated attacker can send a specially crafted Office file and persuade a user to open it in an affected version of Outlook. Microsoft says the file can cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. The connection may disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as that user.
The flaw requires a user to open the file. Microsoft says the Preview Pane is not an attack vector, and the attacker does not need prior privileges on the affected system. The vulnerability does not itself allow code execution, according to the source material. Microsoft rates it Moderate, with a CVSS score of 6.5.
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected, in both 32-bit and 64-bit editions. The stated fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps updates are also available in the November 10 releases for their channels; administrators should check Microsoft’s release details for the applicable channel and build rather than assume all installations update at once.
What Comes First in Patching the Outlook Zero-Day? Prioritize the fix
Microsoft says attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. Apply the update for the affected Office build.
How the attack works
The flaw requires a user to open a crafted file in an affected version of Outlook.
An attacker persuades a user to open a specially crafted Office file.
Outlook may connect to an attacker-controlled network location without the usual warning.
Microsoft says the NTLMv2 hash could help an attacker authenticate as that user.
What to update
Check the edition, update channel, and installed build on deployed devices.
| Affected product | Fixed build or update |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | November 10 channel release; verify the applicable build |
Who must act by the deadline?
CISA’s binding deadline is for U.S. federal civilian executive branch agencies.
- Apply mitigations according to vendor instructions by November 24, 2026.
- Install the applicable Microsoft update.
- CISA urges prioritizing KEV vulnerabilities.
- The cited deadline is not a general legal requirement for private businesses.
What the flaw does and does not do
The credential exposure can create account risk, but the supplied information does not confirm attackers used obtained hashes to access other systems.
A user opens the file
Microsoft says the Preview Pane is not an attack vector.
Hash disclosure
The flaw may expose an NTLMv2 hash that could be used to authenticate as the user.
Impact has limits
The vulnerability does not itself allow code execution, according to the supplied information.
Why the Hash Exposure Matters
The immediate risk is not that opening the file automatically runs code, but that it can expose a credential-related hash that may help an attacker authenticate as the affected user. In an organization, a compromised account can create further security risks, depending on the account’s access and the network’s protections. Microsoft says the hash could be used to authenticate as the user; that is a description of potential impact, not confirmation that attackers have successfully used stolen hashes in every case.
The active-exploitation status changes the patching priority. CISA’s November 10 catalog entry cites evidence of exploitation in the wild. Its binding November 24 deadline applies to federal civilian executive branch agencies under the relevant directive. CISA also urges other organizations to prioritize catalog vulnerabilities, but the date is not a general legal requirement for private businesses.
The flaw’s Moderate rating does not mean it can be ignored. The rating describes Microsoft’s severity assessment, while CISA’s listing reflects evidence of active exploitation. Security teams need to account for both: the attack requires someone to open a file, but the resulting hash disclosure may matter beyond the individual Outlook installation.
Products Worth Considering
Logitech MX Vertical Wireless Ergonomic Mouse
Apple MacBook Pro 16-inch (2021), M1 Pro, 10-core CPU, 16-core GPU, 16GB RAM, 512GB SSD, Silver
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How Microsoft and CISA Responded
Microsoft’s security entry identifies the issue as CVE-2026-124194, also called the Microsoft Outlook Spoofing Vulnerability. The source material says it was the only flaw in Microsoft’s November release marked “Exploitation Detected.” Microsoft attributes the weakness to the product interface not warning users about an unsafe action, and describes the attack as requiring a malicious file and a user who opens it.
CISA added the Outlook issue to its KEV catalog on November 10 as one of six vulnerabilities added that day, citing evidence of active exploitation. The other entries involved products from Cisco, Barracuda Networks, Openwave and Google Chromium. For the Outlook flaw, CISA’s required action is to apply mitigations according to vendor instructions; the catalog entry sets November 24, 2026 as the due date.
CISA says the directive applies only to U.S. federal civilian executive branch agencies. It separately encourages all organizations to use risk-based vulnerability management and prioritize KEV entries. The source material reports that Microsoft lists no workaround or mitigation apart from the update, making installation of the applicable fixed build the stated remediation.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 security entry
What Is Not Yet Public
The available information does not identify who is behind the attacks, which organizations or users were targeted, how many may be affected, or when exploitation began. CISA’s catalog lists ransomware use as unknown. The source material also says the entry does not require federal agencies to conduct the specific forensic triage associated with some other cataloged flaws; that does not establish that no intrusion has occurred.
There is no confirmed public account in the supplied material of attackers using hashes obtained through this flaw to access other systems. The vulnerability’s potential credential impact should not be confused with evidence about the outcomes of particular attacks. Details about exploitation methods beyond Microsoft’s description, and the number of patched or still-vulnerable installations, are also not provided.
Patch Status Before November 24
Federal civilian agencies must meet the November 24, 2026 deadline under CISA’s directive. Organizations using affected Office products should identify their edition and update channel, check the installed build against Microsoft’s fixed versions, and apply the relevant update. Because Office updates may arrive on different schedules, administrators should verify the actual build on deployed devices rather than rely only on a policy setting or an assumption that updates installed automatically.
Organizations outside the federal civilian branch are not bound by that deadline under the cited directive, but CISA recommends prioritizing KEV vulnerabilities. Microsoft or CISA may provide additional details as investigations and remediation proceed. Until then, the confirmed course in the source material is to install Microsoft’s applicable update; no separate workaround is listed.
Key Questions
What does CVE-2026-124194 do?
A crafted file opened in an affected version of Outlook can make the application connect to a server controlled by an attacker without the usual warning. Microsoft says that connection can disclose the user’s NTLMv2 hash, which could be used to authenticate as that user.
Does simply viewing the message in the Preview Pane trigger the flaw?
Microsoft says the Preview Pane is not an attack vector. Its description says the user must be persuaded to open the malicious file.
Who must meet the November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize the vulnerability, but the cited directive does not make the date binding on them.
How can an organization check whether it has the fix?
Administrators should identify the affected Office product and update channel, then compare the installed build with Microsoft’s fixed builds. The source material lists 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024; Microsoft 365 Apps builds vary by channel.
Is there a workaround if the update cannot be installed?
The supplied Microsoft entry lists no workaround or separate mitigation. It identifies the update as the fix. CISA’s catalog guidance says agencies should discontinue use of a product if mitigations are unavailable, though the source material says updates for this flaw have been released.
Source: ThorstenMeyerAI.com
