🔍 Read the full analysis: Outlook Zero-Day Under Attack: A Patch Checklist Before November 24 on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are actively exploiting CVE-2026-124194, an Outlook spoofing flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. The November 10 Office update is the fix; US federal civilian agencies must apply it by November 24, while CISA urges other organizations to prioritize remediation.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash after the user opens a specially crafted file. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10 and set a November 24 deadline for federal civilian agencies to apply the available Office update.
Microsoft classifies the issue as a moderate-severity Outlook spoofing vulnerability, with a CVSS score of 6.5 out of 10. Its account says an attacker without an account on the target system can send a malicious Office file and persuade a user to open it. Outlook may then connect to an attacker-controlled network location without displaying its usual external-content warning, disclosing the user’s NTLMv2 hash.
Microsoft says an attacker could use the exposed hash to authenticate as the user. The attack requires a user to open the file; Microsoft says the Preview Pane is not an attack vector, and the flaw does not itself let an attacker run code. Microsoft and CISA identify the weakness as CWE-356, a product interface failing to warn users about an unsafe action.
Microsoft lists no workaround or separate mitigation; installing the security update is the fix. The source material identifies fixed builds for Office LTSC 2021 (16.0.14334.21048) and Office LTSC 2024 (16.0.17932.21140), as well as November 10 updates for Microsoft 365 Apps channels. Administrators should verify installed build numbers against Microsoft’s applicable release information, since the correct version varies by update channel.
Outlook Zero-Day Under Attack Patch Before November 24
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Installing the applicable Office security update is the fix.
How the flaw works
A user must open a crafted file; Microsoft says the Preview Pane is not an attack vector.
An attacker persuades a user to open a malicious Office file in affected Outlook.
It may connect to an attacker-controlled location without its usual external-content warning.
The disclosed NTLMv2 hash could be used to authenticate as the user.
Who must act by November 24?
The cited CISA directive sets a binding deadline for US federal civilian executive branch agencies.
- Apply the available Office update by November 24, 2026.
- Inventory affected Outlook installations and verify fixed builds.
- The date is not a federal mandate for businesses or individuals.
- CISA urges all organizations to prioritize KEV-listed vulnerabilities.
Patch checklist
There is no workaround listed; install the applicable security update.
Verify the fixed build
Check for build 16.0.14334.21048.
Verify the fixed build
Check for build 16.0.17932.21140.
Match the update channel
Use the fixed build for the installed channel.
Why the November 24 Deadline Matters
The CISA deadline is binding under the cited directive for US federal civilian executive branch agencies, not for every business or individual. CISA’s alert says those agencies must apply vendor instructions by November 24 and discontinue use of a product if mitigations are unavailable. In this case, Microsoft has released an update.
For other organizations, the date is not a federal mandate, but CISA encourages all organizations to prioritize vulnerabilities in its KEV catalog. The disclosed hash can potentially be used to authenticate as a user, making the flaw relevant to organizations that rely on Windows authentication. The source characterizes exploitation as requiring a person to open a file; it does not describe an attack that spreads automatically.
Products Worth Considering
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Outlook Flaw Reached CISA’s List
Microsoft’s November security release identifies CVE-2026-124194 as the Microsoft Outlook Spoofing Vulnerability and marks it as exploited. CISA added it to the KEV catalog on November 10, alongside five other vulnerabilities affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium. CISA said the additions were based on evidence of active exploitation.
The source reports that this was the only flaw in Microsoft’s November release marked “Exploitation Detected.” The CVSS score and “Moderate” rating describe severity, but they do not negate the separate evidence that attackers are using the flaw. CISA’s record lists ransomware use as unknown and does not mark the vulnerability for forensic triage under the cited directive.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 entry
What Attackers and Targets Remain Unknown
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may be affected, or when exploitation began. It also gives no confirmation that the flaw has been used in ransomware campaigns; CISA’s catalog field for ransomware use is listed as unknown.
The source does not provide incident counts or details about particular intrusions. CISA’s “active exploitation” designation confirms that exploitation has been observed, but it does not by itself establish the scale, methods or outcomes of attacks. Organizations should not treat the absence of a forensic-triage designation as proof that no compromise occurred.
Verify Office Builds Before November 24
Federal civilian agencies should apply the vendor update by November 24, 2026, in line with CISA’s directive. IT teams at those agencies and elsewhere should inventory affected Outlook installations, check actual Office build numbers, and deploy the applicable November 10 security update. Microsoft lists fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024; Microsoft 365 Apps administrators should use the fixed build for their specific channel.
Organizations should also follow vendor and CISA guidance for any new information about exploitation or remediation. The source material does not state that a later investigation, new patch or additional deadline has been announced. Until more details emerge, the immediate reported action is to install the available update and confirm that affected systems are running a fixed build.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a crafted Office file opened in an affected Outlook version can make the application connect to an attacker-controlled location without its usual warning. That connection can disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its described attack requires a user to open the malicious file.
Who must meet the November 24 deadline?
The deadline applies to US federal civilian executive branch agencies under the CISA directive cited in the source. CISA encourages other organizations to prioritize KEV-listed vulnerabilities, but the source does not make the date a binding deadline for them.
What is the fix for the Outlook flaw?
Microsoft lists no workaround; installing the applicable Office security update is the fix. Check Microsoft’s release information for the fixed build matching the installed product and update channel.
Is it known who was targeted or how widespread the attacks are?
No. The source material says the attackers’ identity, targets, number of affected users or organizations, and start date are not known. CISA’s listing confirms active exploitation but does not provide those details.
Source: ThorstenMeyerAI.com
