Outlook Zero-Day CVE-2026-124194 Leaks NTLM Hashes: Patch Now
November Patch Tuesday fixes an exploited Outlook zero-day: a crafted message file silently connects to an attacker's server and leaks the user's NTLMv2 hash.
⚡ Why it matters
NTLMv2 hashes can sometimes be cracked to recover the password, or relayed to other services to sign in as you. The flaw is being exploited now, and a Windows update alone does not fix it: Office itself must be updated.
In its November 2026 Patch Tuesday release, Microsoft fixed a Microsoft Outlook vulnerability tracked as CVE-2026-124194. It is classified as a spoofing flaw, and Microsoft confirmed it has been exploited in real-world attacks.
Vulnerability details
According to Microsoft's description, an unauthenticated attacker can send a specially crafted message file and persuade the user to open it. Outlook may then connect to a network location controlled by the attacker without showing the usual external-content warning, and during that connection Windows may send the user's NTLMv2 authentication hash.
- Severity: CVSS 6.5 (medium).
- Exploitation requires the victim to open the file; the Preview Pane is not an attack vector.
- Affected products: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
- CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 10, giving U.S. federal agencies until November 24 to patch.
How big is this month's release?
Counts depend on methodology: Microsoft's official release notes list 1,094 vulnerabilities, while BleepingComputer counted more than 1,200 after including other fixes. Either way, this is the only flaw confirmed as exploited this month.
What to do
- Install the November Office update on every machine that runs Outlook. Reported fixed builds:
16.0.17932.21140for LTSC 2024 and16.0.14334.21048for LTSC 2021. - Check the actual Outlook build on endpoints instead of relying on the deployment status in your management console.
- Block outbound SMB (TCP port 445) to the internet at the firewall.
- Review outbound NTLM restriction policies, and warn staff not to open unexpected message (.msg) files.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.