Microsoft has fixed an actively exploited Outlook spoofing vulnerability that can expose a user’s NTLMv2 authentication hash when they open a specially crafted message file. Tracked as CVE-2026-124194, the flaw is rated Moderate with a CVSS score of 6.5, but Microsoft’s Security Update Guide marks it as having “Exploitation Detected.” BleepingComputer reported that the vulnerability was used in attacks to steal NTLM account hashes.
Microsoft says an unauthenticated attacker can send a specially crafted message file and persuade a target to open it in an affected version of Outlook. The application then connects to an attacker-controlled network location without showing its usual external-content warning, potentially disclosing authentication information that could be used to impersonate the victim. The attack requires network connectivity and user interaction; the Preview Pane is not an attack vector, according to Microsoft’s CVE-2026-124194 advisory.
The affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, on both 32-bit and 64-bit systems. Microsoft’s November 10 Office security release lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed. Microsoft 365 Apps receive the correction through the company’s Office security release updates.
Trend Micro’s Zero Day Initiative review also identifies CVE-2026-124194 as the only Microsoft vulnerability in the November release marked as exploited. The analysis notes that the flaw’s credential-disclosure impact is more significant than its Moderate severity label might suggest. The attack path is related to the wider risk of NTLM credential theft and relay, which Microsoft has previously addressed in part by making SMB signing the default in Windows 11.
The November fix follows Microsoft’s October security release, which included a separate actively exploited Windows Shell zero-day. That earlier update was covered in Abijita’s report on Microsoft’s October Patch Tuesday fixes. Microsoft has not publicly identified the attackers or described the scale of the Outlook exploitation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
