Microsoft Outlook Zero-Day CVE-2026-124194 Leaks NTLMv2 Hashes Through Crafted Message Files

Microsoft Outlook Zero-Day CVE-2026-124194 Leaks NTLMv2 Hashes Through Crafted Message Files

Microsoft’s November 2026 security release includes a medium-severity Outlook flaw that is already being exploited. Tracked as CVE-2026-124194, the issue can disclose a user’s NTLMv2 authentication hash when the user opens a specially crafted message file.

Why a CVSS 6.5 flaw deserves urgent attention

The vulnerability is classified as a spoofing issue and requires user interaction: an attacker sends a crafted message file and convinces the recipient to open it. Microsoft says the Preview Pane is not an attack vector. That limitation reduces the number of automatic exploitation paths, but it does not make the issue low priority because exploitation has already been detected and CISA has added the CVE to its Known Exploited Vulnerabilities catalog.

The leaked hash is not a plaintext password. It can still be valuable: an attacker may use captured authentication material to attempt relay or pass-the-hash activity against services that accept NTLM. The practical risk depends on the victim’s privileges, reachable internal services, and whether outbound authentication controls are enforced.

What defenders should do today

First, verify the actual Office build on every managed endpoint rather than assuming Windows Update has covered the application. Microsoft’s November 10 release notes list fixed builds including Office LTSC 2021 version 2108 build 14334.21048, Office LTSC 2024 version 2408 build 17932.21140, and current Microsoft 365 Apps channel builds beginning with version 2610 build 20527.20196. Channel-specific deployment can differ, so validate the build inventory after rollout.

Second, review telemetry for unusual outbound authentication from OUTLOOK.EXE, especially connections to external or untrusted hosts after a user opens a message file. Correlate endpoint, mail-gateway, firewall, and domain-controller logs. Treat unexpected NTLM authentication as an investigation lead, not proof of exploitation.

Third, reduce the value of any captured credential material. Block outbound SMB from endpoints to the public internet, restrict outbound NTLM where operationally possible, and review privileged-account exposure. If an endpoint may have opened a malicious file before patching, follow the organization’s incident response process and assess whether the account or host requires containment and credential rotation.

The operational lesson

CVE-2026-124194 is a reminder that severity scores and exploitation status answer different questions. A 6.5 score describes the modeled impact and attack conditions; the KEV listing says defenders should treat exploitation as an active prioritization signal. Patch the Office application, validate the deployed build, and hunt for unexpected outbound authentication instead of waiting for a higher score.

Sources

• Microsoft Office security update release notes
• Microsoft Security Response Center: CVE-2026-124194
• CISA Known Exploited Vulnerabilities Catalog

References

1. Microsoft Office security update release notes
2. Microsoft Security Response Center: CVE-2026-124194
3. CISA Known Exploited Vulnerabilities Catalog