CVE-2026-124194: Microsoft Outlook Zero-Day Exploited to Steal NTLM Hashes

Microsoft has patched CVE-2026-124194, an actively exploited zero-day vulnerability in Microsoft Outlook that can expose a user’s NTLMv2 authentication information when a specially crafted message file is opened. Microsoft classifies the issue as a spoofing vulnerability and rates it Moderate with a CVSS 3.1 score of 6.5.

The vulnerability allows an unauthenticated remote attacker to send a malicious message file and convince a victim to open it in an affected Outlook version. Outlook can then connect to an attacker-controlled network location without displaying the external-content warning users would normally expect. During that connection, Windows may expose NTLMv2 authentication information that can potentially be abused to impersonate the victim.

Contact Sales

Microsoft confirmed that CVE-2026-124194 has already been exploited in attacks. However, the company has not disclosed the threat actors involved, the scale of the campaign, victim organizations, delivery infrastructure, or whether the stolen authentication material has been used for subsequent lateral movement or account compromise.

The flaw was addressed as part of Microsoft’s November 2026 Patch Tuesday release on November 10. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10, confirming evidence of active exploitation and establishing November 24, 2026 as the remediation deadline for applicable U.S. federal agencies.

Security teams can use SOC Prime’s AI-Native Detection Intelligence Platform to operationalize threat intelligence, identify suspicious Outlook and NTLM activity, and accelerate detection engineering and threat hunting across SIEM, EDR, XDR, and Data Lake environments.

Detect CVE-2026-124194 by correlating Outlook activity with unexpected outbound SMB connections, NTLM authentication attempts to external systems, suspicious message-file execution, and subsequent credential or identity abuse.

Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new threat intelligence and detection content are continuously added.

CVE-2026-124194 analysis

CVE-2026-124194 affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Microsoft assigns the flaw a CVSS 3.1 score of 6.5 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting remote accessibility, low attack complexity, no required attacker privileges, required user interaction, and high confidentiality impact.

The vulnerability is classified under CWE-356, Product UI Does Not Warn User of Unsafe Actions. In practical terms, Outlook does not display the warning that should normally alert a user before the application accesses potentially dangerous external content.

Exploitation begins with a specially crafted Outlook message file delivered to the target. The attacker does not need an account on the victim’s system or Microsoft 365 tenant, but the victim must open the malicious file. Microsoft specifically states that the Preview Pane is not an attack vector, meaning simply displaying the message in Outlook’s preview interface is not sufficient.

Once the file is opened, Outlook can initiate a connection to a network location controlled by the attacker without presenting the usual external-content warning.

This is significant because Windows environments can automatically attempt NTLM authentication when accessing remote resources. The resulting challenge-response exchange can expose the user’s NTLMv2 authentication hash to the remote server.

An NTLMv2 hash is not the user’s plaintext password. However, possession of authentication material can create several follow-on risks depending on the environment and the attacker’s capabilities. BleepingComputer notes that captured hashes may be subjected to offline password cracking, while Microsoft’s advisory warns that the leaked authentication information can potentially be used to authenticate as the victim.

This makes the vulnerability particularly relevant to enterprise environments that still rely heavily on NTLM for file shares, legacy applications, remote resources, or internal authentication workflows.

The CVSS score of 6.5 may initially appear relatively modest for a zero-day under active exploitation. The score reflects the fact that exploitation requires user interaction and primarily affects confidentiality rather than directly delivering code execution, integrity loss, or service disruption.

Operational risk is nevertheless considerably higher because Microsoft has already observed exploitation and CISA has independently added the flaw to KEV. Security teams should therefore prioritize exploitation status over CVSS alone when determining remediation urgency.

The CVE record identifies the following affected and fixed versions:

Product	Affected versions	Fixed version
Microsoft 365 Apps for Enterprise	Vulnerable releases before the applicable November security update	Current Office Security Release
Microsoft Office LTSC 2021	Earlier than 16.0.14334.21048	16.0.14334.21048
Microsoft Office LTSC 2024	Earlier than 16.0.17932.21140	16.0.17932.21140

Both 32-bit and x64 installations are affected. Organizations using Microsoft 365 Apps should rely on Microsoft’s Office Security Releases information because build numbers differ across servicing channels.

Microsoft published CVE-2026-124194 on November 10, 2026 and released the corresponding security updates through Patch Tuesday. The vulnerability was not publicly disclosed before a fix became available.

Microsoft credits a researcher using the moniker “nono” and security researcher Benoît Sevens with discovering or reporting the issue. SecurityWeek notes that Microsoft’s acknowledgment for Sevens references the use of Anthropic’s Claude AI model during the research. The available sources do not provide the exact date on which the vulnerability was privately discovered or initially reported to Microsoft.

The CVE-2026-124194 PoC landscape remains less important than the confirmed exploitation status. Microsoft and the two supplied reports do not provide public exploit code or detailed reproduction instructions. Some third-party exploit aggregators have produced conflicting signals regarding newly published proof-of-concept material, so defenders should not rely on public PoC availability when assessing risk. Active exploitation has already been independently established through Microsoft and CISA.

For CVE-2026-124194 detection, defenders should monitor endpoint and network activity together. One particularly valuable signal is OUTLOOK.EXE initiating SMB traffic toward an external or previously unseen destination shortly after a user opens an Outlook message file.

Outbound TCP port 445 traffic deserves particular attention. Microsoft recommends blocking outbound SMB traffic to the internet as a general defense-in-depth control because it can prevent internal devices from sending SMB data directly to external hosts.

Security teams can also review Microsoft’s NTLM Operational log under Applications and Services Logs/Microsoft/Windows/NTLM and audit outgoing NTLM authentication. Microsoft provides a policy specifically designed to audit or deny outgoing NTLM traffic to remote servers.

Useful behavioral hunting pivots include:

• Outlook initiating unexpected external SMB connections.
• NTLM authentication attempts toward internet destinations.
• Successful authentication to internal services shortly after suspicious Outlook activity.
• Message-file activity associated with unusual external network connections.
• Repeated authentication attempts involving the same compromised identity.
• New logons from systems or IP addresses inconsistent with the user’s normal activity.

Defenders should avoid treating every outbound SMB or NTLM connection as proof of exploitation. Both technologies can still exist legitimately in enterprise environments. The strongest detections will correlate Outlook activity, destination reputation, user interaction, NTLM telemetry, and subsequent authentication behavior.

Microsoft has not published campaign-specific CVE-2026-124194 IOCs such as malicious IP addresses, domains, attachment hashes, sender addresses, or filenames associated with the observed attacks. The identity of the attackers and their targeting remain undisclosed.

This means organizations currently need to prioritize behavior-based hunting rather than static IOC matching.

CVE-2026-124194 Mitigation

The primary remediation is to install Microsoft’s November 2026 Office security updates immediately.

Office LTSC 2021 installations should be updated to build 16.0.14334.21048 or later, while Office LTSC 2024 installations should run 16.0.17932.21140 or later. Microsoft 365 Apps for Enterprise users should verify that their servicing channel has received the corresponding current security release.

Because exploitation is already occurring, organizations should verify successful deployment rather than assuming automated Office updates have reached every device.

Administrators should take the following actions:

1. Inventory Microsoft Outlook installations across managed endpoints.
2. Identify Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 systems that have not received the November security update.
3. Deploy the corrected builds immediately and verify installation.
4. Review endpoints that remained vulnerable while exploitation was active.
5. Block unnecessary outbound SMB traffic to the internet.
6. Audit outgoing NTLM authentication and reduce NTLM usage wherever operationally possible.
7. Investigate unusual Outlook-to-network activity and unexpected authentication attempts.
8. Educate users not to open unsolicited Outlook message files or attachments from untrusted sources.

Blocking outbound SMB on TCP port 445 provides an important additional protection layer. Microsoft explicitly recommends preventing SMB traffic from leaving the corporate network unless there is a specific operational requirement for internet-hosted SMB services.

Organizations should also consider restricting NTLM. Windows provides the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy, which can first be configured in audit mode to identify dependencies before administrators begin blocking authentication.

Abruptly disabling NTLM across an enterprise can break legacy applications and workflows. Organizations should therefore audit usage, identify legitimate dependencies, implement required exceptions, and progressively move authentication toward Kerberos or other stronger mechanisms.

If suspicious exploitation is identified, merely installing the update is not sufficient to close the incident.

Security teams should identify the affected identity and review authentication activity occurring after the suspected message file was opened. Look for unusual SMB connections, remote logons, lateral movement, access to file shares, VPN authentication, cloud sign-ins, and other services that accept the affected credentials.

Where evidence suggests that authentication information was exposed or successfully abused, reset the relevant password and revoke active sessions according to the organization’s identity-response procedures. Additional privileged credentials accessible to the affected account should also be investigated.

Endpoint, proxy, firewall, email, EDR, and identity logs should be preserved before remediation when compromise is suspected. Correlating these sources can help reconstruct the sequence from phishing delivery through NTLM disclosure and possible subsequent authentication.

CISA added the vulnerability to KEV on November 10 and requires applicable federal agencies to remediate it by November 24, 2026. CISA lists known ransomware campaign use as unknown.