Microsoft Patches Actively Exploited Outlook Zero-Day That Exposes NTLM Hashes

Microsoft has patched CVE-2026-124194, an actively exploited zero-day vulnerability in Microsoft Outlook that can expose a user's NTLMv2 authentication information when a specially crafted message file is opened. Microsoft classifies the issue as a spoofing vulnerability and rates it Moderate with a CVSS 3.1 score of 6.5.

The vulnerability

The vulnerability allows an unauthenticated remote attacker to send a malicious message file and convince a victim to open it in an affected Outlook version. Outlook can then connect to an attacker-controlled network location without displaying the external-content warning users would normally expect. During that connection, Windows may expose NTLMv2 authentication information that can potentially be abused to impersonate the victim.

Microsoft confirmed that CVE-2026-124194 has already been exploited in attacks. However, the company has not disclosed the threat actors involved, the scale of the campaign, victim organizations, delivery infrastructure, or whether the stolen authentication material has been used for subsequent lateral movement or account compromise.

The flaw was addressed as part of Microsoft's November 2026 Patch Tuesday release on November 10. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10, confirming evidence of active exploitation and establishing November 24, 2026 as the remediation deadline for applicable U.S. federal agencies.

Affected versions and fixes

The CVE record identifies the following affected and fixed versions:

Both 32-bit and x64 installations are affected. Organizations using Microsoft 365 Apps should rely on Microsoft's Office Security Releases information because build numbers differ across servicing channels.

Microsoft credits a researcher using the moniker "nono" and security researcher Benoît Sevens with discovering or reporting the issue. SecurityWeek notes that Microsoft's acknowledgment for Sevens references the use of Anthropic's Claude AI model during the research. The available sources do not provide the exact date on which the vulnerability was privately discovered or initially reported to Microsoft.

Mitigation

The primary remediation is to install Microsoft's November 2026 Office security updates immediately. Office LTSC 2021 installations should be updated to build 16.0.14334.21048 or later, while Office LTSC 2024 installations should run 16.0.17932.21140 or later. Microsoft 365 Apps for Enterprise users should verify that their servicing channel has received the corresponding current security release.

Because exploitation is already occurring, organizations should verify successful deployment rather than assuming automated Office updates have reached every device.

Administrators should take the following actions:

• Inventory Microsoft Outlook installations across managed endpoints.
• Identify Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 systems that have not received the November security update.
• Deploy the corrected builds immediately and verify installation.
• Review endpoints that remained vulnerable while exploitation was active.
• Block unnecessary outbound SMB traffic to the internet.
• Audit outgoing NTLM authentication and reduce NTLM usage wherever operationally possible.
• Investigate unusual Outlook-to-network activity and unexpected authentication attempts.
• Educate users not to open unsolicited Outlook message files or attachments from untrusted sources.

Blocking outbound SMB on TCP port 445 provides an important additional protection layer. Microsoft explicitly recommends preventing SMB traffic from leaving the corporate network unless there is a specific operational requirement for internet-hosted SMB services.

Organizations should also consider restricting NTLM. Windows provides the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy, which can first be configured in audit mode to identify dependencies before administrators begin blocking authentication.

Abruptly disabling NTLM across an enterprise can break legacy applications and workflows. Organizations should therefore audit usage, identify legitimate dependencies, implement required exceptions, and progressively move authentication toward Kerberos or other stronger mechanisms.

If suspicious exploitation is identified, merely installing the update is not sufficient to close the incident. Security teams should identify the affected identity and review authentication activity occurring after the suspected message file was opened. Look for unusual SMB connections, remote logons, lateral movement, access to file shares, VPN authentication, cloud sign-ins, and other services that accept the affected credentials.

Where evidence suggests that authentication information was exposed or successfully abused, reset the relevant password and revoke active sessions according to the organization's identity-response procedures. Additional privileged credentials accessible to the affected account should also be investigated.

Endpoint, proxy, firewall, email, EDR, and identity logs should be preserved before remediation when compromise is suspected. Correlating these sources can help reconstruct the sequence from phishing delivery through NTLM disclosure and possible subsequent authentication.

Why it matters

CISA added the vulnerability to KEV on November 10 and requires applicable federal agencies to remediate it by November 24, 2026. CISA lists known ransomware campaign use as unknown. Microsoft has not published campaign-specific CVE-2026-124194 IOCs such as malicious IP addresses, domains, attachment hashes, sender addresses, or filenames associated with the observed attacks. The identity of the attackers and their targeting remain undisclosed. This means organizations currently need to prioritize behavior-based hunting rather than static IOC matching.

---

Sources

• socprime.com: CVE-2026-124194: Outlook Zero-Day Exposes NTLM Hashes
• techrepublic.com: Microsoft Patches 1,235 Security Flaws: Outlook Zero-Day Already Under Attack
• gbhackers.com: Microsoft Outlook Zero-Day Vulnerability Actively Exploited to Steal NTLM Authentication Hashes
• cyberpress.org: Hackers Exploit Microsoft Outlook Zero-Day to Steal NTLM Credentials in Active Attacks

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.