CVE-2026-124194: Outlook zero-day leaks NTLM hashes

Call: Patch now. CVE-2026-124194 is being exploited. Microsoft marks it “Exploitation Detected,” and CISA added it to KEV on November 10 with a due date of November 24. It’s the only exploited bug in November’s Microsoft release. Microsoft rates it Moderate, CVSS 6.5. Ignore the rating. The score is low because someone has to open a file, and getting someone to open a file is the entire business model of phishing.

What breaks: For the attacker, Outlook’s external-content warning. Per Microsoft’s advisory, an attacker sends “a specially crafted message file” and convinces the user to open it. Outlook then connects to an attacker-controlled network location “without displaying the usual external-content warning.” That connection hands over the user’s NTLMv2 hash, which Microsoft says the attacker “could use to authenticate as the user.” The Preview Pane is not an attack vector, so the user has to actually open it. Microsoft hasn’t said who is exploiting it, against whom, or since when, and we found no published indicators.

Who’s hit: Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 and Office LTSC 2021. Fixed builds:

Office LTSC 2024: 16.0.17932.21140 (Version 2408, Build 17932.21140)
Office LTSC 2021: 16.0.14334.21048 (Version 2108, Build 14334.21048)
Microsoft 365 Apps: the November 10 builds, e.g. Current Channel Version 2610 (Build 20527.20196); Monthly Enterprise Channel 2610 (20527.20194), 2609 (20430.20264) or 2608 (20326.20320)

This is an Office update, not a Windows one. The Windows cumulative update doesn’t fix it, and a machine that’s current on Windows can still be exposed.

Workaround: None from Microsoft. Install the Office update and check the build, because Click-to-Run channels move on their own schedule and “it’ll update itself eventually” is not a compliance report. While that rolls out, the usual NTLM-leak hygiene helps and doesn’t replace the patch:

Block outbound SMB (TCP 445) to the internet at the perimeter.
Put privileged accounts in Protected Users, or restrict outgoing NTLM where you can.
Tell people not to open message files they weren’t expecting.

Sources: MSRC CVRF, November 2026 (opens in a new tab), Office security release notes (opens in a new tab), CISA KEV (opens in a new tab), SecurityWeek (opens in a new tab), The Register (opens in a new tab), ZDI (opens in a new tab).

CVE-2026-124194: Outlook zero-day leaks NTLM hashes

Sources

More from November 2026 patch cycle