An explainer on a Microsoft Outlook vulnerability where opening a crafted message file leaks the user's NTLMv2 hash. It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.
- CVE
- CVE-2026-124194 (Microsoft Outlook Spoofing Vulnerability)
- Severity
- CVSS v3.1 6.5 (Medium; vector AV:N/AC:L/PR:N/UI:R/C:H; assigned by Microsoft, same value in NVD). MSRC severity: Moderate
- Type
- Product UI does not warn the user of unsafe actions (CWE-356); spoofing
- Impact
- Opening a crafted message file makes Outlook connect out without an external-content warning, leaking an NTLMv2 hash. The Preview Pane is not a vector
- Affected
- Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise
- Fix
- LTSC 2021: 16.0.14334.21048 / LTSC 2024: 16.0.17932.21140 / Microsoft 365 Apps: see the Office security releases page
- Published
- 10 November 2026 (Patch Tuesday)
- Exploitation
- Microsoft marks it exploited (Exploited: Yes). Added to CISA KEV on 10 November 2026 (due 24 November)
Risk of waiting
A hash is not the plaintext password, but Microsoft's advisory says the attacker could use it to authenticate as the user. Where users can authenticate to internal shares and services with NTLM, one leaked hash can become a foothold into whatever that user can reach.
What kind of vulnerability is it
Microsoft's advisory says an unauthenticated attacker could send a crafted message file and persuade a user to open it. Outlook may then connect to an attacker-controlled location without displaying the usual external-content warning, disclosing authentication information that could be used to impersonate the user. It is classified as CWE-356 (product UI does not warn the user of unsafe actions).
- Exploitation needs network connectivity and user interaction. UI:R in the CVSS vector means the user must be persuaded to open a malicious Office file.
- Microsoft states the Preview Pane is not an attack vector.
- What leaks is the NTLMv2 hash. Confidentiality impact is high (C:H) while integrity and availability are unaffected, which gives 6.5.
- The advisory does not describe how the file is built or how the connection works, and this site does not either.
Affected scope
| Item | Detail |
|---|---|
| Product | Microsoft Outlook (Office LTSC 2021 / Office LTSC 2024 / Microsoft 365 Apps for Enterprise, 32-bit and 64-bit) |
| Fix (LTSC 2021) | 16.0.14334.21048 |
| Fix (LTSC 2024) | 16.0.17932.21140 |
| Fix (Microsoft 365 Apps) | See the Office security releases page (aka.ms/OfficeSecurityReleases) |
| Workarounds / mitigations | None found in the advisory data |
| Customer action | Required (Microsoft: Customer Action Required: Yes) |
- Versions not listed (for example older Office releases) are not covered by the advisory. If you run them, ask Microsoft.
- Even with automatic updates, the update channel setting can delay delivery. Verify the actual build.
How to check whether you are affected
Check your Office build
In Outlook, go to File, then Office Account, then About Outlook to see the build. LTSC 2021 below 16.0.14334.21048 or LTSC 2024 below 16.0.17932.21140 is affected. For Microsoft 365 Apps, look up the fixed build for your channel on the releases page. With many endpoints, list them as in the asset inventory checklist.
Check how updates are delivered
Find out whether updates are automatic or managed by an administrator. If delivery is paused, check that November's Patch Tuesday updates are not held back.
Check outbound SMB and NTLM today
Check whether endpoints can reach the internet over SMB (TCP 445), and whether a setting restricting outbound NTLM is in place. If these are open, a leaked hash does more damage.
What to do today
Update Office to the fixed build or later (top priority)
Move LTSC 2021 to 16.0.14334.21048 or later and LTSC 2024 to 16.0.17932.21140 or later. For Microsoft 365 Apps, find your channel's fixed build on the Office security releases page and update. KEV's due date is 24 November, but exploitation is confirmed, so do not wait for the deadline.
Block outbound SMB at the perimeter
As a general defence, block SMB (TCP 445) from your internal network to the internet at the firewall. Even if a user opens a crafted file, the hash is then less likely to reach an external destination. If you use SMB for file sharing with outside parties, confirm the use case first.
Restrict outbound NTLM
Microsoft documents a Windows policy, "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers", that can audit or deny outgoing NTLM (Microsoft Learn). Setting it straight to "Deny all" can break business processes, so start with "Audit all" to see actual usage, then tighten in stages.
Follow up with users who may have opened such a file before the update
If a user recalls opening a suspicious message file, change their password and check their sign-in history for anything unusual. What leaks is a hash derived from the password, so changing the password makes the leaked hash unusable. Strengthen account protection as well (multi-factor authentication guide).
Tell users
Tell users not to open message files or attachments of unknown origin. Typical phishing patterns are covered in What is phishing.
Exploitation status
- Microsoft's advisory lists Publicly Disclosed as No and Exploited as Yes.
- CISA added it to KEV on 10 November 2026 with a due date of 24 November (KEV version 2026.11.10). KEV names it "Missing User Interaction for Potentially Unsafe Action".
- KEV lists ransomware use as Unknown and forensic triage as No.
- CISA's assessment is appended to the CVE record (exploitation: active; automatable: no; technical impact: partial).
- NVD status is Analyzed, carrying Microsoft's 6.5.
- No public information on the scale, techniques or actors of the attacks could be confirmed. The advisory carries an acknowledgment of the reporter.
Priorities from the same November Patch Tuesday
Microsoft's CVRF (machine-readable security update data) for November 2026 contains 1,342 entries. These include third-party products such as the Chromium vulnerabilities that Edge ingests, so this site does not state a count of Microsoft-only products. Of them, 68 are rated Critical, while CVE-2026-124194 itself is Moderate. Below are the main Critical ones as confirmed in the CVRF. Within the CVRF, this CVE is the only one marked as exploited.
| CVE | Product | In brief |
|---|---|---|
| CVE-2026-118207 | Exchange Server (Subscription Edition) | Remote code execution (CVSS 8.8). Targets an authenticated low-privilege attacker. Rated exploitation more likely |
| CVE-2026-119958 | Windows LDAP | Remote code execution (CVSS 9.8). No authentication. Rated exploitation less likely |
| CVE-2026-116928 | Windows Search | Remote code execution (CVSS 9.8). The advisory describes a path via Exchange automatically processing attachments. Rated exploitation less likely |
| CVE-2026-119952 | Windows Schannel | Remote code execution (CVSS 8.1). No authentication. Rated exploitation more likely |
| CVE-2026-118146 | Active Directory Domain Services | Remote code execution (CVSS 8.8). Rated exploitation more likely |
- "Exploitation more or less likely" is Microsoft's Exploitability Index rating, separate from whether exploitation has actually been observed (Exploited).
- This is a selection of the main ones. Check Microsoft's advisories for the other Critical entries.
Sources
- Microsoft — CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability (published 10 November 2026; affected products, fixed builds, exploited, CVSS 6.5)
- Microsoft — MSRC CVRF, November 2026 security updates (Critical list and exploitability ratings)
- Microsoft — Microsoft 365 Apps security updates (Office build list)
- Microsoft Learn — Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers (audit or deny outgoing NTLM)
- CVE.org — CVE-2026-124194 (published 10 November 2026; includes CISA's addition)
- NVD — CVE-2026-124194 (Analyzed; CVSS 6.5)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 10 November; due 24 November)
Blocking outbound SMB (TCP 445) is listed here by this site as a general defence; it is not a workaround stated in Microsoft's advisory. Last verified: 11 November 2026.
Read next
- Practice: The vulnerability remediation playbook / Asset inventory checklist
- Deciding: Prioritising with CVSS, EPSS and KEV
- Authentication: Multi-factor authentication guide
- Terms: What is phishing / What is CVSS?