A newly disclosed Microsoft Outlook zero-day vulnerability is being actively exploited to expose users’ Windows authentication information, giving attackers another way to target corporate identities without first compromising an account. Tracked as CVE-2026-124194, the vulnerability allows an attacker to send a specially crafted message file to a victim and trigger an outbound connection to an attacker-controlled network location when the recipient opens the file in Outlook. That connection can expose the user’s NTLMv2 authentication hash.
Microsoft released a security update for the vulnerability on November 10th, 2026, and confirmed that exploitation had already been detected. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, setting a November 24 remediation deadline for applicable federal agencies.
Although Microsoft assigns CVE-2026-124194 a Moderate severity rating and a CVSS score of 6.5, organizations should not interpret that rating as a reason to delay remediation. The vulnerability has a confirmed exploitation status, affects widely deployed Office products, and can expose authentication material that may be useful in subsequent identity-based attacks.
Organizations should prioritize installing the applicable security updates, reviewing outbound NTLM authentication, and investigating suspicious connections originating from Outlook.
What is CVE-2026-124194?
CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability caused by the application failing to provide an appropriate warning before performing a potentially unsafe action. Microsoft classifies the weakness under CWE-356, which describes software that does not warn users about unsafe actions.
In this case, the missing warning concerns Outlook connecting to an external network location when a user opens a specially crafted message file. An attacker does not need to authenticate to the target environment before sending the file. However, successful exploitation requires the recipient to open it, meaning the vulnerability is not a zero-click attack.
Microsoft's published CVSS 3.1 score is 6.5, with a vector that identifies network accessibility, low attack complexity, no required attacker privileges, and required user interaction. The confidentiality impact is rated high, while the direct integrity and availability impacts are rated none. This reflects the vulnerability's primary risk: disclosure of authentication information rather than direct execution of arbitrary code or disruption of a system.
Microsoft has confirmed that the vulnerability has been exploited in the wild. However, its public advisory does not identify the threat actors, targeted organizations, campaign size, or specific attack infrastructure. Organizations should avoid assuming that the activity is connected to earlier Outlook campaigns simply because those attacks involved similar products or authentication mechanisms.
How the Outlook Zero-Day Attack Works
The attack begins when an attacker sends a specially crafted message file to a target. The attacker must then persuade the recipient to open that file using an affected version of Outlook. When the file is opened, Outlook may attempt to connect to a network resource controlled by the attacker.
Under normal circumstances, users may receive a warning before Outlook accesses certain external content. CVE-2026-124194 involves a failure to display the expected warning, removing an opportunity for the user to recognize and stop the potentially unsafe connection.
During the connection, Windows may disclose the user's NTLMv2 authentication information. NTLM, or New Technology LAN Manager, is an authentication protocol used by Windows systems and applications. NTLMv2 is a more secure version of the protocol, but it remains susceptible to attacks involving captured authentication exchanges, including relay and cracking techniques under certain conditions.
The attacker does not necessarily receive the user's plaintext password. Instead, the exposed authentication material can potentially be used in further attempts to impersonate the user, conduct offline password-cracking attempts, or abuse authentication flows that accept NTLM. The practical impact depends on the captured material, the target environment's authentication configuration, password strength, network controls, and the privileges associated with the affected account.
This distinction matters because CVE-2026-124194 is not itself a direct remote code execution vulnerability. It creates an opportunity to expose authentication information, which may then become one stage in a broader intrusion. If an attacker can successfully abuse the captured material, the compromised identity could provide access to additional systems, files, or business applications.
Microsoft has also clarified that the Outlook Preview Pane is not an attack vector for this vulnerability. Users must open the malicious file for exploitation to occur. Security teams should communicate this distinction accurately rather than describing the flaw as a zero-click vulnerability.
Why Exposed NTLMv2 Authentication Data Matters
Authentication information is a valuable target because it can provide a path into systems without requiring attackers to exploit a separate software vulnerability. Organizations may invest heavily in endpoint protection and perimeter security while overlooking the risks associated with legacy authentication protocols and excessive identity privileges.
NTLM authentication is particularly relevant in environments where older applications, file servers, and infrastructure still depend on it. Attackers who obtain NTLM authentication material may attempt to use it in relay attacks, where authentication exchanges are forwarded to another service, or in offline cracking attempts designed to recover the underlying password. The success of these techniques depends on several factors, including network configuration, protocol protections, account privileges, and password complexity.
A compromised employee identity can also create opportunities for lateral movement. If an account has access to shared drives, internal applications, administrative tools, or sensitive business information, an attacker may attempt to use that access to expand their presence. The consequences can extend beyond the original endpoint, particularly when the account has permissions that exceed what the employee needs to perform their role.
This is why organizations should treat authentication exposure as an identity security issue, not simply an email security problem. Outlook is the initial attack surface, but the potential consequences involve Windows authentication, network access, and the permissions assigned to the affected user.
The incident also reinforces the importance of reducing dependence on NTLM wherever practical. Microsoft provides policies that allow administrators to audit and restrict outgoing NTLM traffic. However, organizations should assess compatibility requirements before enforcing broad restrictions, as legacy applications and services may still rely on the protocol. A phased approach can help identify dependencies and reduce the risk of disrupting legitimate business operations.
Which Microsoft Products Are Affected?
Microsoft identifies the following affected products for CVE-2026-124194:
Microsoft 365 Apps for Enterprise, 32-bit and 64-bit editions
Microsoft Office LTSC 2021, 32-bit and 64-bit editions
Microsoft Office LTSC 2024, 32-bit and 64-bit editions
Microsoft has published security updates to address the vulnerability. For Office LTSC 2021, the reported fixed build is 16.0.14334.21048 or later. For Office LTSC 2024, the reported fixed build is 16.0.17932.21140 or later. Microsoft 365 Apps administrators should consult Microsoft's Office security release guidance to confirm the appropriate update for their servicing channel.
Organizations should inventory their Office installations rather than assuming that a centralized update deployment has reached every endpoint. Remote devices, systems that are not regularly connected to corporate networks, and machines with delayed update schedules can remain exposed after an update campaign begins.
Administrators should verify installed build numbers and confirm that the relevant security update has been applied successfully. Where possible, this verification should be supported by endpoint management and vulnerability management tools rather than relying exclusively on deployment status reports.
CISA Adds CVE-2026-124194 to Its Known Exploited Vulnerabilities Catalog
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10th, 2026. The catalog identifies vulnerabilities for which there is evidence of active exploitation and is used by organizations to inform remediation priorities.
CISA established November 2th4, 2026, as the remediation deadline for applicable U.S. federal agencies. Although the binding requirements apply to federal civilian agencies under the relevant directive, the catalog is also a useful resource for private-sector organizations assessing vulnerability risk.
The addition is significant because it provides further confirmation that the Outlook flaw is not merely theoretical. Organizations should prioritize the vulnerability based on its exploitation status, exposure, and potential consequences rather than relying on the Moderate severity label alone.
A vulnerability's CVSS score is one input into risk prioritization, not a complete measure of the threat facing an organization. Exploitation in the wild, the prevalence of affected software, the sensitivity of exposed information, and the privileges associated with targeted accounts can all change the urgency of remediation.
For organizations that use Microsoft 365 Apps or Office LTSC, the practical response is to identify affected installations, deploy the relevant security updates, and verify remediation. Security teams should also review authentication and network telemetry for signs of suspicious activity.
How Organizations Can Detect Potential Exploitation
Microsoft has confirmed exploitation but has not publicly provided a comprehensive set of campaign-specific indicators of compromise, such as malicious IP addresses, domains, file hashes, or sender addresses. This limits the usefulness of static indicator matching as a standalone detection strategy.
Organizations should instead prioritize behavioral monitoring and correlation across endpoint, email, identity, and network security tools.
One useful detection opportunity is unexpected outbound network activity initiated by Outlook. Security teams can investigate instances in which OUTLOOK.EXE initiates connections to external or previously unseen network destinations, particularly when the activity follows the opening of an unfamiliar message file. Outbound SMB traffic and unexpected NTLM authentication attempts to external systems deserve particular scrutiny.
Other useful signals include unusual authentication activity involving accounts that recently opened suspicious attachments, unexpected NTLM authentication to unfamiliar servers, and authentication events that do not align with the user's normal access patterns. Security teams should correlate these events with endpoint process telemetry, email security logs, firewall records, and identity provider activity.
Detection rules should account for legitimate business activity. Some organizations may have approved workflows that generate unusual network connections or use NTLM authentication for compatibility reasons. A single outbound connection should not automatically be treated as proof of exploitation. Instead, analysts should assess the destination, process lineage, timing, user activity, and surrounding authentication events.
If suspicious activity is identified, incident responders should determine whether authentication information may have been exposed and whether the affected account has been used in subsequent access attempts. Depending on the investigation, response measures may include isolating an endpoint, disabling or restricting an account, resetting credentials, revoking active sessions where supported, and reviewing access to sensitive resources.
The first priority is to install Microsoft's November 2026 security updates for all affected Outlook and Office installations. Organizations should use Microsoft's Security Update Guide and Office release information to determine the correct update for each deployment channel. After installation, administrators should verify that endpoints are running fixed builds.
Patching should be accompanied by an assessment of outbound authentication controls. Organizations should review whether Windows endpoints can initiate NTLM authentication to arbitrary external systems and determine whether those connections are necessary. Blocking unnecessary outbound SMB traffic at network boundaries can reduce opportunities for authentication information to be sent to untrusted destinations. This should be implemented with attention to legitimate business dependencies and network architecture.
Microsoft also provides controls for auditing and restricting outgoing NTLM authentication. Administrators can begin by auditing NTLM traffic to identify which applications and services rely on it. Once dependencies are understood, organizations can consider restricting or blocking outbound NTLM authentication, with carefully managed exceptions where required. Enforcing restrictions without an impact assessment can disrupt legacy applications and business workflows.
Email security controls should also be reviewed. Organizations should consider how they handle unsolicited message files, attachment types, and messages that encourage users to open unfamiliar content. Filtering and attachment inspection can reduce exposure, but these controls should complement patching and identity protections rather than replace them.
Finally, organizations should review account privileges and authentication protections. Applying least privilege, using phishing-resistant multifactor authentication where supported, monitoring unusual authentication patterns, and limiting unnecessary access to sensitive systems can reduce the impact of a compromised identity. Multifactor authentication should not be treated as a complete mitigation for NTLM exposure, because the attack concerns authentication material that may be abused through mechanisms that do not necessarily follow a standard interactive sign-in flow.
What This Vulnerability Means for Enterprise Security
CVE-2026-124194 illustrates how a seemingly narrow application flaw can create broader identity, application, and network security risks. The initial interaction takes place in Outlook, but the exposed information belongs to the Windows authentication environment. If that information is successfully abused, the incident can extend beyond the user's mailbox or workstation.
The vulnerability also highlights the limitations of relying on severity scores as the sole basis for patch prioritization. A Moderate CVSS rating does not mean an actively exploited vulnerability can safely wait, particularly when the affected application is widely deployed and the exposed information could support further access.
Organizations should use this incident as an opportunity to evaluate how email applications interact with external resources, how Windows systems handle outbound authentication, and whether legacy protocols remain necessary across the environment. These questions are relevant beyond this specific vulnerability. Reducing unnecessary authentication exposure can help limit the impact of future phishing, credential theft, and network-based attacks.
Penetration testing can help organizations assess whether weaknesses in email handling, identity controls, network segmentation, and authentication configurations create practical paths to sensitive systems. A focused assessment can evaluate how an attacker might move from an initial user interaction to credential abuse or unauthorized access, and whether existing monitoring and response controls would detect that activity.
The immediate response to CVE-2026-124194 is clear: patch affected Office installations, verify remediation, and review outbound NTLM activity. The broader lesson is that email security, endpoint security, and identity security must operate together. Protecting one layer while leaving authentication pathways exposed can give threat actors opportunities to turn a single user interaction into a much larger security incident.
Frequently Asked Questions
What is the Microsoft Outlook zero-day vulnerability CVE-2026-124194?
CVE-2026-124194 is an actively exploited Microsoft Outlook spoofing vulnerability that can expose a user's NTLMv2 authentication information. When a recipient opens a specially crafted message file in an affected version of Outlook, the application may connect to an attacker-controlled network location without displaying the expected external-content warning.
Is CVE-2026-124194 a zero-click vulnerability?
No. Exploitation requires user interaction. An attacker must send a specially crafted message file and persuade the recipient to open it in Outlook. Microsoft has also confirmed that the Preview Pane is not an attack vector for this vulnerability.
The vulnerability can expose a user's NTLMv2 authentication hash. This is not the same as directly obtaining the user's plaintext password, but attackers may be able to use the captured authentication information in relay attacks, offline password-cracking attempts, or other attempts to impersonate the user, depending on the environment's security controls.
Which Microsoft Office products are affected by CVE-2026-124194?
Microsoft identifies Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 as affected products. Both 32-bit and 64-bit editions are included. Administrators should consult Microsoft's security update guidance to identify the correct fixed release for their Office deployment.
Has Microsoft patched the Outlook zero-day?
Yes. Microsoft released security updates for CVE-2026-124194 on November 10, 2026, as part of its November security updates. Organizations should install the applicable update and verify that affected endpoints are running fixed builds.
Why is CVE-2026-124194 important if Microsoft rates it Moderate?
The vulnerability has a CVSS score of 6.5 and a Moderate severity rating, but Microsoft has confirmed active exploitation. Its potential to expose authentication information makes it important for organizations that rely on Outlook and Windows authentication. Exploitation status, affected systems, and business impact should all factor into patch prioritization.
How can organizations detect exploitation of CVE-2026-124194?
Security teams should monitor for unexpected outbound connections initiated by Outlook, unusual SMB traffic, and NTLM authentication attempts to external or unfamiliar destinations. Correlating endpoint, email, network, and identity logs can help identify suspicious activity. Microsoft has not published a comprehensive set of campaign-specific indicators of compromise, making behavioral detection particularly important.
How can organizations protect against the Outlook zero-day?
Organizations should install Microsoft's November 2026 security updates, verify affected Office installations are patched, and review outbound NTLM authentication policies. They should also restrict unnecessary outbound SMB traffic, monitor suspicious authentication activity, apply least-privilege access controls, and strengthen email security measures. NTLM restrictions should be tested before enforcement to avoid disrupting legitimate applications.
Does multifactor authentication prevent NTLM hash theft?
Multifactor authentication is an important identity security control, but it should not be considered a complete mitigation for this vulnerability. CVE-2026-124194 involves exposure of NTLMv2 authentication information, which may be abused through authentication mechanisms that do not necessarily involve a conventional interactive sign-in. Organizations should combine MFA with patching, outbound authentication restrictions, least privilege, and monitoring.
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24, 2026, remediation deadline for applicable U.S. federal agencies. Private-sector organizations can also use the catalog as a reference when prioritizing remediation.
