🔍 Read the full analysis: Outlook Zero-Day Under Attack: The Patches To Prioritize Now on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when the user opens a crafted file. Microsoft has issued updates, and CISA set a November 24, 2026, remediation deadline for U.S. federal civilian agencies; the source does not provide all affected Microsoft 365 build details.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 authentication hash after the user opens a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24 deadline for federal civilian agencies to act; Microsoft says Office updates are the fix.
Microsoft describes the issue as a spoofing vulnerability. A crafted Office message file can prompt Outlook to connect to a network location controlled by an attacker without displaying the usual external-content warning. Microsoft says that connection may disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as the user. The flaw does not itself allow code execution, according to the supplied material.
The attack requires a user to open the malicious file; Microsoft says the Preview Pane is not an attack vector. The source characterizes the flaw as requiring no attacker account or prior privileges, while still depending on a recipient opening the file. Microsoft rates it Moderate, with a CVSS score of 6.5 out of 10. Its entry lists no workaround or mitigation, making the security update the recommended fix.
Microsoft identifies Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected. It lists fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, the supplied source gives November 10 builds for some update channels, including Current Channel Version 2610, Build 20527.20196, and several Monthly Enterprise Channel versions. Its list of Semi-Annual Enterprise Channel builds is cut off, so administrators should check Microsoft’s current security guidance for the complete channel-specific requirements.
Outlook Zero-Day Under Attack:Prioritize the Patches
Attackers can expose a user’s NTLMv2 hash if they open a crafted file. Microsoft has issued updates; administrators should check their Office builds and apply the relevant fix.
How the attack works
The risk is credential exposure, not code execution.
The attack requires a recipient to open a specially crafted file in affected Outlook.
It can connect to an attacker-controlled network location without the usual external-content warning.
The disclosed NTLMv2 hash could be used to authenticate as the affected user.
Who needs to act
The deadline’s scope depends on the organization.
- Meet CISA’s November 24 remediation deadline.
- Apply the available Office update.
- CISA urges risk-based prioritization of KEV vulnerabilities.
- The federal deadline is not a general legal requirement for private organizations.
Check affected Office builds
Microsoft lists these products as affected; compare installed versions with current security guidance.
| Product | Update detail in source |
|---|---|
| Office LTSC 2021 | Fixed build 16.0.14334.21048 |
| Office LTSC 2024 | Fixed build 16.0.17932.21140 |
| Microsoft 365 Apps for Enterprise | Some November 10 channel builds listed; Semi-Annual details are incomplete |
What the source confirms
The reported details set boundaries on what teams can conclude.
Opening is required
Microsoft says the Preview Pane is not an attack vector.
Downstream misuse
The source does not establish whether stolen hashes were used to access other accounts or systems.
Some builds are missing
Check Microsoft’s current guidance for complete Microsoft 365 channel requirements.
Why Exposed Outlook Hashes Matter
The concern is not only that a warning can be bypassed. Microsoft says a successful attack can disclose authentication material that could be used to authenticate as the affected user. In a workplace, a user’s credentials may provide access to organizational services and data, although the source does not establish that attackers used any disclosed hashes to enter other systems.
The CISA listing signals that the agency considers the flaw to have evidence of active exploitation. The November 24 deadline is binding for U.S. federal civilian executive branch agencies under the directive cited in the source. CISA also urges other organizations to prioritize vulnerabilities in its KEV catalog, but that deadline is not a general legal requirement for private organizations. For IT teams, the practical priority is checking installed Office builds and applying the relevant update rather than relying on a workaround.
Products Worth Considering
Jackery Explorer 1000 v2 Portable Power Station
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
How the November KEV Listing Works
CISA added the Outlook issue to its KEV catalog on November 10 as one of six vulnerabilities it said were included based on evidence of active exploitation. The other entries concerned products from Cisco, Barracuda Networks, Openwave and Google Chromium, according to the supplied source. CISA’s entry calls the Outlook issue a missing-user-interaction warning vulnerability and sets a remediation date of November 24, 2026.
The directive applies only to federal civilian agencies. CISA’s catalog also lists ransomware use as unknown and does not mark the flaw for forensic triage under the field described in the source. CISA’s risk record is reported as classifying exploitation as active, automability as no, and technical impact as partial. The source interprets those fields as suggesting a need for a user to interact with the file; that interpretation is not a statement by CISA about specific campaigns or targets.
Microsoft’s rating of Moderate and the presence of active exploitation describe different aspects of the issue: severity scoring reflects the vulnerability’s technical characteristics, while the exploitation status indicates that attacks have been observed. The source says this was the only flaw in Microsoft’s November release marked “Exploitation Detected,” but does not provide enough detail here to independently assess the broader release.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its description of CVE-2026-124194
What Is Not Yet Known
The supplied source does not identify who is behind the attacks, which organizations or people were targeted, how many may have been affected, or when exploitation began. It also does not establish whether attackers have used stolen NTLMv2 hashes to access additional accounts or systems. CISA’s ransomware-use field is listed as unknown, so the source does not support a claim that the flaw has been used in ransomware campaigns.
The source’s Microsoft 365 build list is incomplete: it begins listing Semi-Annual Enterprise Channel versions but ends before giving all build numbers. Administrators should consult Microsoft’s current security update entry for the complete affected-product and fixed-build details. The source also does not give a full account of observed attacks or say whether Microsoft or CISA has issued further findings since the catalog update.
Check Builds Before the Deadline
Federal civilian agencies must meet CISA’s November 24, 2026 deadline by applying the vendor’s fix or following the directive’s instructions if mitigation is unavailable. The supplied material says updates are available for this Outlook flaw. Other organizations are encouraged by CISA to prioritize the catalog entry according to their risk-management processes.
IT administrators should verify the installed Office version and update channel, compare the build with Microsoft’s current security guidance, and deploy the applicable update. Because no workaround is listed, the source does not describe an alternative that substitutes for patching. Further details about targets, attack timing and any downstream account misuse remain dependent on additional reporting from Microsoft, CISA or affected organizations.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says opening a specially crafted file can cause Outlook to connect to an attacker-controlled network location and disclose a user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the crafted file.
Which Office versions are listed as affected?
The supplied source lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit editions. Check Microsoft’s current guidance for the full channel-specific build list.
Who must meet the November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the directive cited by CISA. CISA recommends that other organizations prioritize KEV vulnerabilities, but the source does not describe the deadline as binding on them.
Is there a workaround?
The supplied source says Microsoft lists no workaround or mitigation for this flaw and identifies the Office security update as the fix.
Source: ThorstenMeyerAI.com
