Microsoft Patches Exploited Outlook Flaw That Leaks NTLM Hashes

Microsoft's November 2026 security updates fix an Outlook vulnerability that attackers were already exploiting. Tracked as CVE-2026-124194 and listed by Microsoft as a spoofing flaw, it lets an attacker who sends a crafted message file make Outlook connect to a server under the attacker's control without showing the usual external-content warning. That connection can hand over the user's NTLMv2 hash, which the attacker can then use to authenticate as that user.

The fix shipped on Patch Tuesday, 10 November 2026. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities catalog. For anyone who runs Outlook on the desktop, the attack starts in the inbox.

How the flaw works

Microsoft's advisory gives the attack path in plain terms. An unauthenticated attacker sends a specially crafted message file and convinces the user to open it in an affected version of Outlook. Opening the file can cause Outlook to connect to an attacker-controlled network location "without displaying the usual external-content warning". During that connection, Outlook can disclose the user's NTLMv2 hash.

Microsoft classes the weakness as CWE-356, a product interface that does not warn the user of an unsafe action. The CVSS vector requires user interaction: the victim has to open the file. Microsoft also states that the Preview Pane is not an attack vector, so simply viewing a message in the reading pane does not trigger the flaw.

The impact score is high for confidentiality only. Integrity and availability are rated as not affected, because the flaw discloses information rather than changing data or systems. The risk lies in what an attacker can do with a stolen hash: Microsoft says it "could use this to authenticate as the user".

Why a Moderate rating still matters

With a base score of 6.5 and a Moderate severity, CVE-2026-124194 would normally sit low on a patch list. The difference is that Microsoft's own exploitability assessment reads "Exploitation Detected", and it is the only vulnerability in the November 2026 release that Microsoft marks as exploited. Microsoft also flags it as "Customer Action Required", and its advisory lists security updates but no workaround or mitigation.

CISA's listing adds a deadline. US federal civilian agencies must apply the fix by 24 November 2026 under BOD 26-04. That date only binds those agencies, but CISA encourages every organisation to use the KEV catalog to decide what to patch first.

A heavy month for Outlook

CVE-2026-124194 is one of 20 Outlook vulnerabilities in Microsoft's November 2026 release. The other 19 are 18 remote code execution flaws and one information disclosure flaw, all marked as not exploited and "Exploitation Less Likely". They are fixed by the same Office updates, so a single update cycle covers the whole set.

Fixed versions

Microsoft's Microsoft 365 Apps security update notes list the builds released on 10 November 2026. Among them:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264) and Version 2608 (Build 20326.20320)
• Semi-Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262) and Version 2608 (Build 20326.20318)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

Devices that are offline, deferred by policy or pinned to an older build stay exposed until they receive one of these builds.

Action checklist

• Update Office on every machine that runs desktop Outlook, and confirm the build matches the 10 November 2026 releases listed above.
• Check deferred devices first: machines on a delayed update ring, laptops that were offline and volume-licensed LTSC installs.
• Brief the people who open outside files, such as support, sales, marketing and abuse desks, not to open unexpected message files until their client is patched.
• Review NTLM use with your security team, including whether your network lets NTLM authentication leave for the internet.
• Watch for odd sign-ins on accounts whose users report opening a suspicious file, and reset credentials if needed.
• Keep inbound filtering strict for attachments from senders who fail authentication; our guide to email spoofing covers how forged senders get through.

Sources

1. Microsoft Security Response Center: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026 (primary source)
2. Microsoft: November 2026 Security Updates release notes
3. Microsoft Learn: Release notes for Microsoft 365 Apps security updates
4. CISA: Known Exploited Vulnerabilities Catalog, entry added 10 November 2026
5. NIST NVD: CVE-2026-124194

Related on SMTPedia

• How to detect phishing emails that pass every check
• Email spoofing explained: how it works and how to stop it
• Microsoft 365 SMTP, IMAP and POP3 settings