MediumCVSS6.52026-11-11
CVE-2026-124194 — Microsoft Outlook spoofing vulnerability leaks the NTLMv2 hash: explainer and fix (patched in the November Patch Tuesday, listed in KEV)
A flaw in Microsoft Outlook where the product UI does not warn the user of an unsafe action (CWE-356). Microsoft's advisory says that if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and an NTLMv2 hash is disclosed. CVSS is 6.5 (medium), yet it is the only vulnerability in the November 2026 Patch Tuesday marked as exploited, and CISA added it to KEV on 10 November (due 24 November). This site's view: do not defer it because the score is moderate; apply the Office update and restrict outbound SMB and NTLM on the assumption that hashes can leak.