TL;DR
Microsoft and CISA say attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a malicious file is opened. Microsoft lists Office updates as the fix; US federal civilian agencies have a November 24 deadline.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash after the user opens a specially crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24 remediation deadline for US federal civilian agencies. Microsoft lists Office updates as the fix.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft describes the issue as a spoofing vulnerability. A malicious file opened in an affected version of Outlook can cause the app to connect to a network location controlled by an attacker without showing the usual external-content warning. Microsoft says the attacker could obtain the user’s NTLMv2 hash through that connection and could use it to authenticate as the user. The flaw does not itself provide code execution, according to the supplied vulnerability details.
The attack requires a user to open the malicious file, but Microsoft says the attacker does not need an account or prior privileges on the victim’s system. Microsoft also says the Preview Pane is not an attack vector. The description identifies the missing warning as the core weakness: Outlook does not alert the user before making the potentially unsafe connection.
Microsoft rates the vulnerability Moderate, with a CVSS score of 6.5 out of 10. Its affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Microsoft lists fixed builds of 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024, along with November 10 builds for each Microsoft 365 Apps channel. IT teams should compare installed builds with Microsoft’s applicable update guidance.
Why the Hash Exposure Matters
The flaw matters because a leaked authentication hash can put an organization’s accounts and internal systems at risk. Microsoft says an attacker could use the exposed hash to authenticate as the user. That creates a potential path from a file opened by one employee to further access using that employee’s identity, although the source material does not establish that such follow-on access occurred in these attacks.
The requirement that a person open the file limits how the attack can spread: it is not described as a self-propagating exploit. But it leaves email users and organizations exposed to targeted messages that persuade someone to open a file. Microsoft’s moderate rating does not change the active-exploitation status recorded by CISA. For federal civilian agencies, the KEV listing carries a fixed deadline; for other organizations, CISA urges risk-based prioritization of catalog vulnerabilities.
Microsoft lists no workaround or separate mitigation for this issue. That makes checking and applying the relevant Office update the central response described in the available material. Organizations should also use their normal security processes to review suspicious activity, while recognizing that CISA’s catalog entry does not mark this flaw for required forensic triage under the directive described in the source.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
Jackery Solar Generator 1000 v2 with Two 100W Solar Panels, 1024Wh LiFePO4 Battery
As an affiliate, we earn on qualifying purchases.
From Disclosure to KEV Listing
CISA’s November 10 alert added six vulnerabilities to its KEV catalog, citing evidence of active exploitation. The additions involved products from Microsoft, Cisco, Barracuda Networks, Openwave and Google Chromium. CISA’s entry names the Outlook issue as a missing user interaction warning for a potentially unsafe action.
The catalog deadline is tied to CISA’s binding directive for federal civilian executive branch agencies. The alert says the directive applies only to those agencies, which must apply vendor mitigations by November 24 or discontinue use of a product if mitigations are unavailable. Microsoft has supplied updates for the affected Office products. CISA separately encourages other organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.
The source material says the flaw was the only vulnerability in Microsoft’s November release marked “Exploitation Detected.” That status and CISA’s later KEV addition put the Outlook issue at the center of patching decisions, even with a moderate severity rating. The supplied account refers to a broader Patch Tuesday release but does not provide additional details needed to assess the other flaws.
““An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.””
— Microsoft Security Update Guide
What Attackers and Targets Remain Unknown
The available source material does not identify who is behind the exploitation, which organizations or users were targeted, how many may have been affected, or when the activity began. CISA lists use in ransomware campaigns as unknown. The KEV addition confirms active exploitation according to CISA, but it does not provide those incident details.
CISA’s NVD scoring records the flaw as active, not automatable and of partial technical impact. The source author interprets that combination as pointing toward targeted messages rather than a fast-spreading worm; that is analysis, not a stated CISA conclusion. The supplied information also does not say whether any exposed hashes were used to access accounts or systems.
Apply the November Office Updates
Organizations should identify whether they run Microsoft 365 Apps for Enterprise or Office LTSC 2021 or 2024, then check installed builds against Microsoft’s update guidance for the relevant product and channel. Microsoft lists the November 10 updates as the fix and provides no workaround in the cited entry. Federal civilian agencies face the November 24, 2026 deadline; other organizations can use the same date as a prompt to prioritize remediation.
Administrators should track Microsoft’s update guidance for any later changes and follow their established incident review procedures if they suspect exploitation. The supplied material does not announce a further CISA milestone or describe a confirmed victim list, so those details remain open.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a specially crafted file opened in an affected Outlook version can make the app connect to an attacker-controlled network location without the usual warning. That connection can expose the user’s NTLMv2 hash.
Does opening the Preview Pane trigger the flaw?
Microsoft says the Preview Pane is not an attack vector. Its described attack requires a user to open the malicious file.
Which Office products are affected?
The source lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, including 32-bit and 64-bit editions. Check Microsoft’s guidance for the applicable channel and build.
What are the fixed builds?
Microsoft lists build 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, the listed fix is the November 10 build for each channel.
Who must meet the November 24 deadline?
CISA’s binding directive applies to US federal civilian executive branch agencies. CISA encourages other organizations to prioritize KEV-listed vulnerabilities, but the supplied alert does not make that deadline binding on them.
Source: Thorsten Meyer AI
