🔍 Read the full analysis: Outlook Zero-Day Under Attack: Steps To Take Ahead Of November 24 on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when the user opens a specially crafted file. CISA added it to its Known Exploited Vulnerabilities catalog on November 10 and set a November 24 deadline for US federal civilian agencies. Microsoft lists its November 10 Office updates as the fix and lists no workaround.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 authentication hash after the user opens a specially crafted file. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24 deadline for US federal civilian agencies to apply the available Microsoft update.
Microsoft describes the issue as a spoofing vulnerability. A malicious Office file can prompt Outlook to connect to a network location controlled by an attacker without displaying the usual external-content warning. Microsoft says that connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user. The flaw does not itself provide code execution, according to the source material.
The attack requires a user to open the file; Microsoft says the Preview Pane is not an attack vector. The attacker does not need prior authentication. Microsoft rates the vulnerability Moderate, with a CVSS score of 6.5. CISA’s entry identifies exploitation as active; its record also marks the attack as not automatable and its technical impact as partial.
Microsoft lists no workaround or mitigation in its vulnerability entry. The source material identifies fixed builds including Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140, as well as November 10 updates for Microsoft 365 Apps channels. Administrators should check Microsoft’s security update guidance for the fixed build applicable to their deployment and confirm the update has installed, rather than relying only on an update policy being enabled.
Outlook Zero-Day Under Attack Steps Before November 24
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Microsoft has released an update; CISA urges organizations to prioritize patching.
How the attack works
A crafted file opened in affected Outlook can prompt a connection to an attacker-controlled location.
The documented attack requires a user to open a malicious file.
The connection can disclose the user’s NTLMv2 hash, which could be used to authenticate as that user.
What to patch
The affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
Check the update channel
Fixed builds vary by channel. Verify the applicable build against Microsoft’s release information.
Verify installed build
Fixed builds include 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.
Who must act
The November 24 deadline has a specific scope.
- US federal civilian executive branch agencies must meet CISA’s deadline.
- Apply the vendor update or follow CISA instructions if mitigation is unavailable.
- The deadline is not a universal legal requirement for private companies.
- CISA encourages organizations to prioritize KEV catalog vulnerabilities.
What is known
Active exploitation is confirmed in agency classifications, but the extent and results remain unclear.
- Microsoft says the Preview Pane is not an attack vector.
- The available information does not identify targets, affected organizations, or when exploitation began.
- CISA’s ransomware field is unknown; the listing does not establish a ransomware connection.
Why the Outlook Hash Exposure Matters
The vulnerability matters because a stolen authentication hash can put a user’s account at risk beyond the initial Outlook interaction. Microsoft says the hash could be used to authenticate as the user; the potential consequences depend on the account’s access and the organization’s defenses. The flaw does not, on the information provided, prove that an attacker has gained access to a particular network or account.
Its Moderate rating does not mean it can be ignored: Microsoft and CISA both indicate active exploitation. The requirement for a user to open a file limits the attack path compared with a flaw that can be triggered automatically, but it still makes the issue relevant to organizations that receive malicious or unexpected files. Applying the update closes the documented vulnerability; it does not establish whether an organization was previously targeted.
The November 24 date has a specific scope. It is a binding deadline for federal civilian executive branch agencies under CISA’s directive, not a universal legal requirement for private companies. CISA nevertheless encourages all organizations to prioritize vulnerabilities in the KEV catalog, making the date a practical remediation target for other Outlook users as well.
Products Worth Considering
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
LG UltraGear 27GX704A-B 27-Inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
CISA’s November 10 Listing
CISA added the Outlook issue to its Known Exploited Vulnerabilities catalog on November 10, alongside five other vulnerabilities in products from Cisco, Barracuda Networks, Openwave and Google Chromium. The agency said the additions were based on evidence of active exploitation. The catalog’s required action is to apply mitigations according to vendor instructions, or discontinue use if mitigations are unavailable.
For this Outlook flaw, Microsoft has released updates, so the source material points users to patching rather than a workaround. CISA’s directive, BOD 26-04, applies only to federal civilian executive branch agencies. CISA separately urges other organizations to use risk-based vulnerability management and prioritize catalog entries.
The source material says Microsoft identifies Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions, as affected. The Microsoft 365 Apps fixed builds vary by update channel. For example, the source lists Current Channel version 2610, build 20527.20196, and several Monthly Enterprise and Semi-Annual Enterprise builds. Administrators should verify the applicable channel and build against Microsoft’s release information.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 security entry
What Attackers Have Done Is Unknown
The available information does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. CISA’s catalog marks use in ransomware campaigns as unknown, so the listing does not establish a connection to ransomware.
CISA’s entry also does not mark this flaw for forensic triage under the directive. That catalog field is not proof that no systems were compromised; it indicates that this vulnerability is not designated for that additional check in the listed process. Organizations still need to use their own incident-response procedures if they find signs of suspicious activity.
The source material does not provide independent incident reports or details about individual attacks. Active exploitation is confirmed by the agencies’ classifications, but the scale and results of those attacks remain unclear.
Patch Before the November 24 Deadline
Federal civilian agencies must meet the November 24, 2026 deadline by applying the vendor update or following CISA’s instructions if a mitigation is unavailable. Microsoft has released the fix, so affected organizations should identify their Office product and update channel, check the installed build, and install the corresponding November 10 security update if it is missing.
Organizations outside the federal directive are not bound by that date, but CISA recommends prioritizing KEV vulnerabilities. IT teams should also communicate that opening a suspicious file is the documented trigger; merely viewing it in the Preview Pane is not identified by Microsoft as an attack vector. That guidance does not replace patching.
Further details may emerge about the attacks, affected targets or exploitation timeline. Until then, the confirmed next step is to install the applicable Office update and follow Microsoft and CISA advisories for any revised guidance.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says a crafted file opened in an affected Outlook version can make the application connect to an attacker-controlled network location and expose the user’s NTLMv2 hash.
Does opening the Preview Pane trigger the flaw?
Microsoft says the Preview Pane is not an attack vector. The documented attack requires a user to open the malicious file.
Who must meet the November 24 deadline?
The date applies to US federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize KEV vulnerabilities, but the source material does not describe the deadline as binding on them.
Is there a workaround if the update cannot be installed?
Microsoft’s entry lists no workaround or mitigation. The update is the fix. CISA’s catalog says agencies should discontinue use of a product if mitigations are unavailable, but Microsoft has released updates for this flaw.
Do we know who was targeted or whether ransomware was involved?
No. The available information does not identify the attackers, targets, number of affected users, or start date. CISA lists ransomware use as unknown, which is not confirmation of a ransomware connection.
Source: ThorstenMeyerAI.com
