Outlook Zero-Day CVE-2026-124194 Leaks NTLM Hashes

Microsoft patched an exploited Outlook zero-day, CVE-2026-124194, in its November 10, 2026 Patch Tuesday release. A crafted message file, once opened, makes Outlook connect to an attacker-controlled server without the usual external-content warning, leaking the user's NTLMv2 hash. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a November 24 deadline. The fix ships through Office updates, not the Windows cumulative update, so check Outlook builds first.

What happened with the Outlook zero-day

Microsoft lists CVE-2026-124194 as a Microsoft Outlook spoofing vulnerability and marks it "Exploitation Detected." The CVE record classifies the weakness as CWE-356: the product UI does not warn the user of an unsafe action. In plain terms, Outlook skips a security prompt it should have shown.

Microsoft's description of the attack is short: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook." When the file opens, Outlook reaches out to a network location the attacker controls. Windows can authenticate to that location automatically, which hands the attacker the user's NTLMv2 hash. The attacker can then try to crack the hash offline or relay it to sign in elsewhere as that user.

Microsoft says "exploitation requires network connectivity and user interaction." Splashtop's analysis of the advisory notes that the user has to open the file and that the Preview Pane is not an attack vector. Microsoft has not said who is behind the attacks, when they started or how many organizations were hit.

CISA added the flaw to the KEV catalog on November 10, 2026. Federal civilian agencies must apply the fix by November 24, 2026 under BOD 26-04. CISA lists ransomware use as unknown.

Severity: why a 6.5 is on the priority list

The CVSS 3.1 base score is 6.5 (Medium), with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Microsoft rates it Moderate, and Splashtop notes it is the only Moderate-rated CVE in the entire November release. On paper it sits below the 63 Critical fixes shipped the same day.

Do not sort by score here. It is the only flaw in the release with confirmed exploitation, so it goes first. A captured NTLMv2 hash is a credential: if the password is weak it falls to offline cracking, and if signing is not enforced on internal services it can be relayed without cracking at all. Our explainer on what an NTLM hash leak is and how attackers use it walks through both paths.

Who is affected

The CVE record lists three affected products:

Microsoft 365 Apps for Enterprise: fixed in the November security update for your update channel (Microsoft points to its Office security release list for channel builds).
Office LTSC 2021: builds before 16.0.14334.21048 are affected.
Office LTSC 2024: builds before 16.0.17932.21140 are affected.

The exposure is any Windows device where a user opens files in classic Outlook from an affected Office build. Reporting on the release has not covered Outlook for Mac, mobile or the web, so treat those as unconfirmed rather than safe.

The fix is not in the Windows cumulative update

This is the operational trap. The Outlook patch ships in the Microsoft 365 Apps and Office LTSC security updates. According to Splashtop, it is not part of the November Windows cumulative update, KB5132061. A device can show fully patched in your Windows Update reporting and still run a vulnerable Outlook build.

Office Click-to-Run installs update on their own schedule and channel. Volume-licensed LTSC installs follow whatever your deployment tool approves. If your patch dashboard only tracks Windows KBs, it will not tell you whether this one is closed. We cover the process gap in detail in why Office update patching needs its own track.

What to do now

Patch Outlook first. Push the November Office security update to every device that runs Outlook. For LTSC 2021 and LTSC 2024, confirm the installed build is at or above the fixed build listed above. For Microsoft 365 Apps, confirm each device is on the November build for its channel.
Verify, do not assume. Pull an Office build inventory from your management tool and compare it against the fixed builds. Devices that have been offline, users with local admin who paused updates and machines on deferred channels are the usual stragglers.
Block outbound SMB at the edge. Workstations rarely have a business reason to open SMB (TCP 445) sessions to the internet. Blocking that traffic at the perimeter and the host firewall cuts off the most common way a leaked hash leaves your network. See our guide on how to block outbound SMB to stop NTLM hash leaks.
Tighten message file handling. Review how your mail gateway treats message file attachments arriving from outside the organization. Quarantine or strip them where the business allows.
Review NTLM use. List which applications and accounts still authenticate with NTLM and plan the move to Kerberos where you can. Every account that can only use NTLM is an account whose hash is worth stealing.

How to look for signs of exploitation

Microsoft has not published indicators of compromise for this campaign. Without them, the practical checks are network-based:

Review firewall and proxy logs for workstations opening SMB connections to external IP addresses, especially shortly after a user opened an email attachment.
Look for Outlook as the parent process of unexpected outbound connections in your EDR telemetry.
For any user whose hash may have leaked, check for sign-ins from unfamiliar hosts and force a password reset. A long, unique password makes offline cracking far more expensive.

The rest of November Patch Tuesday

Counts differ by outlet. Splashtop, working from Microsoft's release notes, puts the total at 1,094 CVEs, with 63 Critical (48 remote code execution and 15 elevation of privilege). BleepingComputer reports 1,235 flaws and 66 Critical, a figure that includes three Critical Edge bugs. Both agree the Outlook flaw is the only zero-day under active exploitation.

Other fixes worth prioritizing after Outlook:

Outlook remote code execution: three Critical flaws, CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309. None is marked exploited, but they land on the same endpoints, so the same Office update closes them.
Exchange Server CVE-2026-118207: Critical remote code execution, CVSS 8.8, assessed "Exploitation More Likely."
Active Directory Domain Services CVE-2026-118146: Critical remote code execution on domain controllers.
Schannel CVE-2026-119952: Critical remote code execution, CVSS 8.1, reachable by an unauthenticated attacker over the network.

Last month's release also carried an exploited Windows Shell zero-day; if you are still behind, our coverage of CVE-2026-96951 and the Mark of the Web bypass has the details.

What to watch next

Watch for Microsoft or a threat intelligence team to name the actor and publish indicators. Those would let you hunt backwards through mail and firewall logs. Also watch for confirmation on non-Windows Outlook clients and for any change to the CVSS score or exploitation status in the advisory.