🔍 Read the full analysis: Outlook Zero-Day: Patch Now, Then Check CISA’s November 24 Deadline on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says CVE-2026-124194 is being actively exploited to expose users’ NTLMv2 hashes when they open a specially crafted file in Outlook. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10 and set Nov. 24 as the remediation deadline for U.S. federal civilian agencies; Microsoft has released updates and lists no workaround.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 authentication hash if the user opens a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, setting Nov. 24, 2026, as the deadline for U.S. federal civilian agencies to apply the available updates.
Microsoft describes the issue as a spoofing vulnerability affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. A malicious file must be sent to a user, who must open it in an affected Outlook version. Microsoft says this can prompt Outlook to connect to an attacker-controlled network location without the usual external-content warning. That connection may disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
The flaw does not require an attacker to have an account on the target system, but it does require user interaction. Microsoft says the Preview Pane is not an attack vector. The company rates the vulnerability “Moderate” and gives it a CVSS score of 6.5 out of 10. CISA’s catalog marks exploitation as active; its record lists use in ransomware campaigns as unknown.
Microsoft lists no workaround or mitigation in its vulnerability entry; installing the security update is the remedy. The stated fixed builds include Office LTSC 2021 version 16.0.14334.21048 and Office LTSC 2024 version 16.0.17932.21140. Microsoft 365 Apps fixes vary by update channel, so administrators should compare installed builds with Microsoft’s November 10 security release for their specific channel.
Outlook Zero-Day Patch now, check the deadline
Microsoft reports active exploitation of CVE-2026-124194. Install the matching update and verify the Office build.
How the attack works
A user must open a specially crafted file in an affected Outlook version.
Outlook may connect to an attacker-controlled network location without the usual external-content warning.
The connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user.
Who must act by Nov. 24?
CISA’s binding deadline applies to U.S. Federal Civilian Executive Branch agencies.
- Apply the available update by Nov. 24, 2026.
- Verify the installed Office build.
- The date is not a general legal deadline.
- CISA encourages risk-based prioritization of KEV vulnerabilities.
Check the matching update
Microsoft 365 Apps fixes vary by update channel.
| Office product | Listed fixed build |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check November release for your channel |
What is known—and unknown
Microsoft and CISA report active exploitation, but the supplied information leaves the scope unclear.
- Preview Pane is not an attack vector; opening the crafted file is required.
- Microsoft lists no workaround; installing the security update is the remedy.
- Attackers, targets, affected counts, and exploitation start date are unknown.
- CISA lists ransomware use as unknown.
Why the Hash Exposure Matters
The vulnerability creates a risk beyond an unwanted connection: a disclosed authentication hash could help an attacker impersonate a user, according to Microsoft. In an organization, compromised credentials can put accounts and connected systems at risk, although the supplied information does not establish that attackers have used this flaw to move through networks or access particular systems.
The required interaction is a relevant limit. A user must open the crafted file, and Microsoft says merely viewing it in the Preview Pane does not trigger the described attack. That does not remove the need to patch: Microsoft and CISA both report active exploitation, and the update is available. CISA’s Nov. 24 date is binding for federal civilian agencies, while the agency encourages other organizations to prioritize vulnerabilities in its KEV catalog using risk-based remediation.
Popular right now
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
Samsung 65-Inch M70H Series 4K Mini LED Smart TV (2026)
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Hot and Cold Milk Frother
As an affiliate, we earn on qualifying purchases.
How the Federal Deadline Applies
CISA added CVE-2026-124194 to its KEV catalog on Nov. 10, 2026, among six vulnerabilities it said were included based on evidence of active exploitation. The catalog’s required action is to apply mitigations according to vendor instructions and discontinue use of a product if mitigations are unavailable. For Outlook, Microsoft has issued the updates.
CISA says its binding directive applies only to Federal Civilian Executive Branch agencies. The Nov. 24 date is not a general legal deadline for private businesses or individuals. CISA nevertheless recommends that all organizations prioritize KEV vulnerabilities. Microsoft rates this flaw “Moderate,” while CISA’s inclusion reflects reported exploitation, not a claim that every organization or user has been targeted.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 vulnerability description
Targets and Attack Timeline Unknown
The available information does not identify who is behind the attacks, which users or organizations were targeted, how many may be affected, or when exploitation began. CISA’s catalog says ransomware use is unknown. Its record also does not mark this flaw for forensic triage under the directive’s process; that status should not be read as evidence that no compromise has occurred.
Microsoft and CISA have confirmed active exploitation, but the supplied material does not give technical details about specific incidents or confirm that stolen hashes have been used to access accounts. The extent and consequences of exploitation therefore remain unclear.
Verify Office Builds Before Nov. 24
Federal civilian agencies must meet CISA’s Nov. 24, 2026, deadline by applying the vendor update or following applicable instructions if a product cannot be mitigated. Other organizations should check whether their Outlook installations are affected and prioritize installing the matching November security update. Administrators should verify the actual Office build and update channel rather than assume that an update policy has already delivered the fix.
Microsoft’s listed fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps have channel-specific November builds, so teams should consult Microsoft’s release details for their deployment channel. Further information about targets, the duration of exploitation and any confirmed incidents was not provided in the source material.
Key Questions
What does CVE-2026-124194 do?
Microsoft says opening a specially crafted file in an affected Outlook version can make the app connect to an attacker-controlled location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its description says a user must open the crafted file for the attack to work.
Who has to meet the Nov. 24 deadline?
CISA’s deadline applies to U.S. Federal Civilian Executive Branch agencies. CISA encourages other organizations to prioritize KEV vulnerabilities, but the supplied notice does not make the date a binding deadline for them.
Is there a workaround?
Microsoft lists no workaround or mitigation for this flaw. It has released security updates, and organizations should install the version that matches their Office product and Microsoft 365 Apps channel.
Who is exploiting the vulnerability?
The available information does not identify the attackers, their targets, the number of affected organizations or when the exploitation began. CISA also lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
