Microsoft Patches Actively Exploited Outlook Flaw That Can Expose NTLMv2 Hashes
Summary
Microsoft says CVE-2026-124194 is actively exploited. Opening a crafted Outlook message file can expose NTLMv2 authentication data; November 2026 Office updates fix it. Microsoft and CISA confirm exploitation, but actors and campaign scope remain undisclosed.
Key points
- A user must open a specially crafted Outlook message file; Outlook may then connect to an attacker-controlled network location without the expected warning. The Preview Pane alone is not an attack vector.
- Microsoft confirms active exploitation, but has not disclosed the attackers, campaign scale, victims, or whether exposed authentication material was later abused.
- Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Fixed LTSC builds are 16.0.14334.21048 and 16.0.17932.21140, respectively.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a November 24 remediation deadline for applicable U.S. federal agencies.
- The article reports no campaign-specific indicators of compromise; it recommends behavior-based monitoring, including unexpected Outlook-initiated external SMB connections and NTLM authentication.
- Install the November 2026 Office security updates, block unnecessary outbound SMB traffic, and audit or restrict outgoing NTLM authentication.
Article Details
- Vulnerability Types
- Spoofing
- Severity
- Moderate (CVSS 3.1: 6.5)
- Affected Versions
- Microsoft 365 Apps for Enterprise: releases before the applicable November 2026 security update
- Microsoft Office LTSC 2021: versions earlier than 16.0.14334.21048
- Microsoft Office LTSC 2024: versions earlier than 16.0.17932.21140
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block unnecessary outbound SMB traffic to the internet, including TCP port 445.
- Audit outgoing NTLM authentication and restrict or deny outgoing NTLM traffic to remote servers where operationally appropriate.
MITRE ATT&CK
CVE
People
Vendors
Products
Microsoft 365 Apps for EnterpriseAffected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.Microsoft Office LTSC 2021Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.Microsoft Office LTSC 2024Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.Microsoft OutlookMicrosoft has patched CVE-2026-124194, an actively exploited zero-day vulnerability in Microsoft Outlook that can expose a user’s NTLMv2 authentication information when a specially crafted message file is opened.Microsoft WindowsDuring that connection, Windows may expose NTLMv2 authentication information that can potentially be abused to impersonate the victim.