Outlook Zero-Day CVE-2026-124194: Patch Office and Stop NTLM Leaks

In Outlook zero-day CVE-2026-124194, opening a crafted message file can make Outlook contact an attacker's server without its external-content warning. That leaks the user's NTLMv2 hash, which an attacker could use to authenticate as the user. Microsoft fixed it on 10 November 2026 and marks it "Exploitation Detected". Update Office and block outbound SMB (Windows file-sharing) traffic.

Sources checked 11 November 2026.

If your organisation uses Outlook on Windows, this one is for you. Microsoft rates it only "Moderate", and that label is easy to scroll past on a busy Patch Tuesday. Don't.

Microsoft has detected it being exploited, and what it leaks, a user's Windows login hash, can be a starting point for further attacks.

This post covers what Microsoft says, who is affected and which builds fix it, and two network settings that blunt this whole family of attacks. Everything else Microsoft fixed this month is on our Patch Tuesday tracker.

What is the Outlook zero-day CVE-2026-124194?

A zero-day is a flaw attackers are using before the vendor has released a fix, or on the day it does. Microsoft's Security Update Guide entry for CVE-2026-124194 calls it a "Microsoft Outlook Spoofing Vulnerability", released 10 November 2026, and marks it "Exploitation Detected".

Microsoft's own description is short. An unauthenticated attacker "could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user."

Normally Outlook warns you before it reaches out to a server on the internet for content in a message. This flaw skips that warning. The rest of the attack details are left out on purpose: you don't need them to defend against it.

What does the attacker get?

Microsoft's FAQ is direct: "This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user."

NTLM is an older Windows sign-in protocol. When Windows connects to a file server that asks for NTLM, it sends a scrambled proof built from your password, called an NTLMv2 hash, rather than the password itself. Microsoft's own NTLM policy documentation says NTLM and NTLMv2 authentication "is vulnerable to various malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks."

In plain terms: a stolen hash can be passed on to another server to log in as you (relay), or attacked offline to recover a weak password (brute force).

Does the user have to do anything?

Yes, and that matters for how you warn staff. Per Microsoft:

The user must open the file. The attack "requires network connectivity and user interaction."
Previewing is not enough. Microsoft states: "No, the Preview Pane is not an attack vector."
No login is needed by the attacker. They only need to get the file to the user, by email or otherwise, and persuade them to open it.

So the warning for staff is specific: be wary of message files you didn't expect, especially ones sent as attachments, and report them instead of opening them. Microsoft's description says "message file" and doesn't name a file type; Outlook saves messages as .msg files, so that is the obvious one to watch.

Why patch now if it's only "Moderate"?

Microsoft scores CVE-2026-124194 at CVSS 3.1 base 6.5, severity Moderate. CVSS measures how bad a flaw could be in theory. It says nothing about whether anyone is using it.

Two facts outrank the score here:

Microsoft has seen it used. The Security Update Guide lists "Exploited: Yes" and "Publicly disclosed: No". Microsoft has not said when the attacks took place.
CISA lists it as exploited. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, with a due date of 24 November. That deadline binds US federal civilian agencies; for everyone else it is a clear signal of priority.

A medium score with confirmed exploitation should jump the queue ahead of a critical score nobody is using. Our guide to CVSS, EPSS and KEV explains why the three numbers answer different questions.

Which Outlook and Office versions are affected?

Microsoft's update table for CVE-2026-124194 has six rows: three products, each in 32-bit and 64-bit editions.

Product (Microsoft's naming)	Fixed build
Microsoft 365 Apps for Enterprise	See the channel table below
Microsoft Office LTSC 2024	16.0.17932.21140
Microsoft Office LTSC 2021	16.0.14334.21048

Source: MSRC Security Update Guide affected-product data for CVE-2026-124194, read 11 November 2026 (the data behind the update table on the MSRC page). For Microsoft 365 Apps, MSRC points to the Office security release notes. Their 10 November 2026 entry lists CVE-2026-124194 under Outlook, with these builds:

Channel	Version	Build
Current Channel	2610	20527.20196
Monthly Enterprise Channel	2610 / 2609 / 2608	20527.20194 / 20430.20264 / 20326.20320
Semi-Annual Enterprise Channel (receives Monthly Enterprise Channel builds)	2610 / 2609 / 2608	20527.20192 / 20430.20262 / 20326.20318

Source: Microsoft 365 Apps security updates, 10 November 2026 entry, read 11 November 2026.

Is the new Outlook for Windows or Outlook for Mac affected?

Microsoft's update table lists only Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024; it makes no statement on the new Outlook for Windows, Outlook for Mac, Outlook on the web or mobile apps. If you run something not in the table, check the MSRC page rather than assuming you're safe.

What should Outlook users and admins do now?

Work through these in order.

Update Office. Install the November 2026 Office security update for your channel. In any Office app, File > Account > Update Options > Update Now starts it.
Confirm the build. File > Account shows the version and build. Compare it with the tables above. Office that is open keeps running the old code until it restarts, so close and reopen Outlook.
Block outbound SMB to the internet. Ask whoever runs your firewall to block TCP port 445 outbound to the internet. Microsoft's guidance is in the next section.
Cover laptops off the network. Staff at home or on hotel Wi-Fi aren't behind your office firewall. Apply the same block on the device's own firewall.
Tell staff one thing. Don't open unexpected message files; report them.
Watch for the signs listed in the deeper section, and if you find a user who opened a suspicious file before patching, reset their password.

Our emergency patching plan sets out how to move a fix like this one through in days.

Who found it?

Microsoft's acknowledgement lists "Benoît Sevens using Claude with Anthropic". Microsoft's listing says no more than that.

For what AI systems found and fixed in DARPA's competition, see our AIxCC post.

Going deeper: for security and IT teams

Identifiers and scoring. CVE-2026-124194, "Microsoft Outlook Spoofing Vulnerability", is classed CWE-356, Product UI does not Warn User of Unsafe Actions. Microsoft scores it CVSS 3.1 base 6.5, temporal 6.2, vector AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N. Read that as: network, low complexity, no privileges, user interaction required, high confidentiality impact, no integrity or availability impact. That high-C score is the hash disclosure. CVSS stops at the hash; it does not score what an attacker does with it next. In our view, that is why the base number understates the risk in a domain environment. The KEV entry lists it under Microsoft Office, added 10 November 2026, due 24 November.

Mechanism. Per Microsoft, opening a crafted message file makes Outlook connect to an attacker-controlled network location without the external-content prompt. When Windows authenticates to a remote resource that requests NTLM, it answers the server's challenge with an NTLMv2 response derived from the user's credentials. The attacker's server collects that response. Microsoft's FAQ doesn't name the transport. Its 2023 guidance on CVE-2023-23397, an earlier Outlook hash leak, says that "If SMB traffic to the internet is blocked by your organization or otherwise fails", "Windows will fall back to using WebDAV to attempt to complete the connection." That was written about CVE-2023-23397; Microsoft has not said whether the same fallback applies to CVE-2026-124194. Plan your controls so that blocking port 445 is not the only one.

Threat model. The attacker needs only a way to deliver a file and a user who opens it in an affected Outlook on a machine that can reach the attacker's server. They get an NTLMv2 response they can relay to another NTLM-accepting service, or crack offline if the password is weak. Accounts with broad rights are the prize.

In practice: CVE-2023-23397. The closest precedent is the 2023 Outlook flaw, which leaked Net-NTLMv2 hashes. Unlike this one, Microsoft said of it that "The user does not need to interact with the message." Microsoft attributed its exploitation to Forest Blizzard, which it describes as "a Russian state-sponsored threat actor that primarily targets government, energy, transportation" and non-governmental organisations "in the United States, Europe, and the Middle East." It wrote that it "has traced evidence of potential exploitation of this vulnerability as early as April 2022." Its December 2023 update said the actor was "actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers." Hash leaks feed real intrusions. Microsoft has not attributed CVE-2026-124194 to any actor; the 2023 case is a precedent, not the same campaign.

Controls. - Patch to the builds above and verify from File > Account or your management tooling, not from the deployment report. - Outbound SMB. Microsoft's Secure SMB traffic guidance says: "Block TCP port 445 outbound to the internet at your corporate firewall," and that "it is unlikely you need to allow any outbound SMB using TCP port 445 to the internet unless you require it as part of a public cloud offering", naming Azure Files and Office 365. It recommends outbound Windows Defender Firewall rules for guest and public networks, which it says "reduces the odds of phishing attacks that send users to malicious servers to harvest credentials". In our view, apply the same block on each device's local firewall and check VPN split-tunnel settings, so remote users are covered too. - Restrict outgoing NTLM. The policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers lives at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Values are Allow all, Audit all and Deny all. Microsoft's best practice: set Audit all first, review the log, then add needed servers with Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication before moving to Deny all. Microsoft warns that denying all "could degrade productivity", so stage it. No restart is needed. - Protected Users. Microsoft's 2023 guidance says to "Add users to the Protected Users group, which prevents the use of NTLM as an authentication mechanism." In our view, start with privileged accounts and test with a few first. - MFA. The same guidance says to "Use multifactor authentication to mitigate the impact of potential Net-NTLMv2 Relay attacks", and adds: "This will not prevent a threat actor from leaking credentials and cracking them offline." In our view, long, unique passwords for privileged accounts are the practical defence there.

Detection and evidence. - With Audit all set, outgoing NTLM attempts are logged in Applications and Services Log\Microsoft\Windows\NTLM. An NTLM attempt to a public IP address is the signal to alert on. - Firewall or proxy logs: outbound TCP 445 to public addresses. In Microsoft Defender for Endpoint, Microsoft's 2023 guidance says "the NetworkSignatureInspected ActionType should include a SignatureName of NTLM-Challenge", which "indicates a Net-NTLMv2 negotiation was attempted." - The same guidance, under "Microsoft-Windows-SMBClient/Connectivity event logs", says "The ServerName field in EventIds 30800, 30803, 30806, 30804, and 31001 should be monitored" for untrusted servers. Microsoft is clear these show a failed outbound connection, not proof that credentials leaked. - Mail: search for inbound message-file attachments from outside senders as far back as your mail retention allows, and for any user reports of odd attachments. - If a user may have leaked a hash, reset their password and review sign-ins for that account.

Ask your team or provider: Is outbound TCP 445 blocked at every egress, including VPN split tunnels and home-working laptops? Which machines are still below the fixed builds? Where is NTLM still required, and is outgoing NTLM audited? Which privileged accounts are in Protected Users?

Key takeaways

CVE-2026-124194 is an exploited Outlook flaw: opening a crafted message file can make Outlook connect to an attacker's server without the external-content warning and leak the user's NTLMv2 hash.
The Preview Pane is not an attack vector; the user has to open the file.
Rated Moderate (CVSS 6.5), but Microsoft has seen it exploited and CISA added it to KEV on 10 November 2026, due 24 November.
Fixed builds: Office LTSC 2024 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048, and the 10 November 2026 builds for each Microsoft 365 Apps channel.
Block outbound TCP 445 to the internet, audit and then restrict outgoing NTLM, and put privileged accounts in Protected Users.
Microsoft lists the acknowledgement as "Benoît Sevens using Claude with Anthropic".

Sources

Microsoft Security Response Center: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026 (description, FAQ, CVSS, CWE, exploitation status, affected products and fixed builds, acknowledgement; read 11 November 2026)
Microsoft Security Response Center: Security Update Guide affected-product data for CVE-2026-124194 (product rows and LTSC fixed builds; read 11 November 2026)
Microsoft Learn: Microsoft 365 Apps security updates, 10 November 2026 entry (channel builds; CVE listed under Outlook)
CISA: Known Exploited Vulnerabilities Catalog entry for CVE-2026-124194 (added 10 November, due 24 November 2026)
Microsoft Learn: Secure SMB traffic in Windows Server (block outbound TCP 445, firewall rules)
Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers (policy path, values, best practice, audit log)
Microsoft Security Blog: Guidance for investigating attacks using CVE-2023-23397, 24 March 2023, updated 4 December 2023 and 15 February 2024 (Forest Blizzard, mitigations, detection events)
MITRE: CWE-356: Product UI does not Warn User of Unsafe Actions