🔍 Read the full analysis: Outlook Zero-Day: A November 24 Deadline And Your Next Patch Steps on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft and CISA report active exploitation of CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after the user opens a crafted file. U.S. federal civilian agencies have a Nov. 24, 2026, remediation deadline; Microsoft’s November 10 Office updates are the fix, and no workaround is listed.
Microsoft says attackers are exploiting an Outlook vulnerability that can expose a user’s NTLMv2 authentication hash when the user opens a specially crafted file. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on Nov. 10, setting Nov. 24, 2026, as the remediation deadline for U.S. federal civilian agencies; Microsoft’s November 10 Office updates are the fix.
Microsoft identifies the issue as the Microsoft Outlook Spoofing Vulnerability and rates it Moderate, with a CVSS score of 6.5 out of 10. Its description says an unauthenticated attacker can send a specially crafted file and persuade a user to open it in an affected Outlook version. Outlook may then connect to an attacker-controlled network location without showing its usual external-content warning.
That connection can expose the user’s NTLMv2 hash, a credential-related value that Microsoft says an attacker could use to authenticate as the user. The attack requires a person to open the file; Microsoft says the Preview Pane is not an attack vector. The vulnerability does not itself provide code execution, according to the source material.
Microsoft lists Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024 as affected, in both 32-bit and 64-bit editions. The stated fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps fixes vary by update channel; administrators should compare installed versions with Microsoft’s November 10 security release rather than assume that a policy to update has already installed the patch.
Outlook Zero-Day Patch before November 24
Microsoft reports active exploitation of an Outlook flaw that can expose a user’s NTLMv2 hash after they open a crafted file. The available fix is Microsoft’s November 10 Office update.
How the flaw exposes credentials
The described attack requires a person to open a specially crafted file.
The user opens a file sent by an attacker.
It may connect to an attacker-controlled location without the usual warning.
The attacker could use the NTLMv2 hash to authenticate as the user. Preview Pane is not an attack vector.
Who must act by the deadline?
CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
- Nov. 24 deadline under CISA’s directive.
- Apply the update and verify affected Office builds.
- CISA urges prioritizing KEV vulnerabilities.
- Treat the date as a strong target, not a universal legal deadline.
Patch and verify
Microsoft lists Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024 as affected.
Check the fixed build
Microsoft lists 16.0.14334.21048 for the affected editions.
Check the fixed build
Microsoft lists 16.0.17932.21140 for the affected editions.
Check your update channel
Fixed builds vary by channel; compare installed versions with Microsoft’s November 10 security release.
What the information does not establish
The available material does not identify the attackers, targeted organizations, or number of affected systems.
- Ransomware use is listed as unknown.
- It does not confirm successful account access in a specific case.
- No workaround is listed; the update is the stated remedy.
Why the Nov. 24 Deadline Matters
The flaw’s immediate risk comes from the combination of active exploitation and potential credential exposure, not from remote code execution. If an attacker obtains a usable authentication value, it could support further access, depending on the account and the organization’s protections. Microsoft’s description says the attacker could use the disclosed hash to authenticate as the user; it does not establish that every exposed hash leads to account compromise.
The Nov. 24 date is binding under the cited directive for U.S. federal civilian executive branch agencies, not a universal legal deadline for companies or individuals. CISA nevertheless urges other organizations to prioritize vulnerabilities in its KEV catalog. The practical message for non-federal organizations is to treat the date as a strong remediation target and verify that affected Office installations are actually patched.
CISA’s catalog entry says the flaw was added based on evidence of active exploitation. That makes waiting for a broader incident report a poor substitute for applying the available update. Microsoft lists no workaround; the update is the stated remedy.
Products Worth Considering
Oral-B iO Series 3 Rechargeable Electric Toothbrush for Adults, Black, with 2 Brush Heads and Travel Case
Garmin Forerunner 570 GPS Running Smartwatch, 42 mm, Aluminum, Bone/Mango
Oura Ring 5 Smart Ring, Silver, Size 10
As an affiliate, we earn on qualifying purchases.
How Microsoft and CISA Classified It
Microsoft rates CVE-2026-124194 as Moderate, while its release information marks exploitation as detected. CISA added the flaw to its KEV catalog on Nov. 10 among six vulnerabilities from several vendors, citing evidence of active exploitation. The entry identifies the issue as a missing warning for a potentially unsafe action.
CISA’s deadline comes through Binding Operational Directive 26-04 and applies only to federal civilian executive branch agencies. The catalog instructs agencies to apply mitigations according to vendor directions and to discontinue product use if mitigations are unavailable. Microsoft has issued updates for the affected Office products, so the source material identifies patching—not product discontinuation—as the available action here.
CISA’s associated risk fields describe exploitation as active, automatable as no, and technical impact as partial. These classifications do not establish who is conducting the attacks or how broadly they are being used. They do indicate that the documented attack depends on user interaction rather than being an automatically spreading exploit.
“The attacker could use this to authenticate as the user.”
— Microsoft, in its CVE-2026-124194 description
What Is Not Yet Known
The source material does not identify who is behind the attacks, which organizations or users have been targeted, how many may have received malicious files, or when exploitation began. CISA’s catalog lists ransomware use as unknown, so the available information does not establish whether the flaw has been used in ransomware campaigns.
The catalog entry is not marked for forensic triage under the cited directive. That status should not be read as proof that no intrusion has occurred; it describes the entry’s directive-specific classification. The material also does not say whether Microsoft or CISA has confirmed successful account access in any particular case, or provide a count of affected systems.
Microsoft’s update information covers multiple Office products and channels, and the supplied source material does not provide a complete list of Microsoft 365 Apps fixed builds. Administrators should consult Microsoft’s current release information for their channel and confirm the installed build on each relevant device.
Patch Verification Before Nov. 24
Federal civilian agencies should meet the Nov. 24 deadline by applying the Microsoft update and verifying that affected Office installations have reached a fixed build. IT teams should check actual version numbers across Office LTSC and Microsoft 365 Apps channels; an update policy alone does not establish that a device has received the patch.
Other organizations should use the same approach as a priority: identify affected Outlook installations, deploy the applicable November 10 update, and confirm installation. Because Microsoft lists no workaround, disabling or relying on a warning setting is not presented in the source as an alternative fix. Organizations should also follow their own incident-response procedures if they find evidence that a user opened a suspicious file or that credentials may have been exposed.
Further information may come from Microsoft’s security guidance and CISA’s KEV catalog as the deadline approaches. The source material does not set out a separate investigation milestone or report on the attack campaign, so the next confirmed step is patch deployment and verification rather than a stated public disclosure about the attackers.
Key Questions
What does CVE-2026-124194 do?
It can cause Outlook to connect to an attacker-controlled network location without the usual warning after a user opens a specially crafted file. Microsoft says this may expose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the crafted file.
Who must patch by Nov. 24?
The fixed deadline applies to U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize KEV vulnerabilities, but the source does not describe Nov. 24 as a legal deadline for them.
What is the fix?
Microsoft’s November 10 Office updates are the stated fix, and its entry lists no workaround. The required fixed build depends on the Office product and, for Microsoft 365 Apps, the update channel.
Do officials know who is using the flaw or how many were affected?
The available source material does not identify the attackers, targets, number of affected users, or start date of exploitation. CISA lists use in ransomware campaigns as unknown.
Source: ThorstenMeyerAI.com
