Microsoft has patched an actively exploited Outlook zero-day, tracked as CVE-2026-124194, that lets attackers steal Windows authentication material by delivering a malicious message file. The vulnerability was released on November 10, 2026; Microsoft, the assigning CNA, rates its maximum severity as Moderate despite confirmed attacks targeting the flaw.
Opening a specially crafted message file in an affected Outlook installation can cause the client to connect to an attacker-controlled network location without showing Outlook’s normal external-content warning. That connection can disclose the victim’s NTLMv2 authentication information — described by Microsoft as the user’s NTLMv2 hash — enabling attackers to attempt impersonation, support offline password cracking, or perform live relay attacks depending on the environment and protections in place.
Outlook zero-day mechanics and scope
The exploit requires no attacker account or existing privileges; an attacker must only send a crafted message file and convince the recipient to open it. Microsoft notes the issue maps to CWE-356, listed as “Product UI does not Warn User of Unsafe Actions,” and MITRE now calls the weakness “Missing User Interaction for Potentially Unsafe Action.” Because the attack requires user interaction, Microsoft advises it should not be described as a zero-click vulnerability.
Microsoft publishes a CVSS 3.1 base score of 6.5 and a temporal score of 6.2. The supplied vector string is: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C. The vector indicates network access, low attack complexity, no required privileges, required user interaction, unchanged scope, high confidentiality impact, no direct integrity or availability impact, and temporal metrics that reflect high exploit maturity, an official fix, and confirmed reporting.
Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft lists fixed LTSC builds as 16.0.14334.21048 and 16.0.17932.21140 respectively. Administrators are advised to consult the Microsoft advisory for applicable updates and to apply the fixes.
Detection and mitigation steps for SOCs
Organizations should prioritize Office updates, investigate unexpected external authentication attempts, and review suspicious message files that might trigger outbound connections. Related Windows credential-leak incidents underline why reducing unnecessary NTLM use matters. Microsoft also notes that blocking unnecessary outbound SMB connections, enforcing SMB signing, and reviewing NTLM exposure can reduce credential-theft and relay risks, but these controls do not replace patching affected Outlook installations across the organization.
Apply the official updates and follow the Microsoft advisory to close the CVE-2026-124194 attack vector.
