CVE-2026-124194: Microsoft Outlook Vulnerability Exploited, One File Can Leak NTLMv2 Hashes

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook (CVSS 6.5, label Moderate) that was exploited before being patched. If a user opens a malicious message file, Outlook can connect to the attacker's network location without the usual external content warning, resulting in the user's NTLMv2 hash being leaked. Products affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

This flaw has been in the spotlight since Patch Tuesday November 2026 (November 10). Microsoft marked it "Exploitation Detected," and CISA listed it in the Known Exploited Vulnerabilities (KEV) catalog. According to The Hacker News, US federal agencies were given a deadline of November 24, 2026. The fix is ​​already available via a security update this month. A score of 6.5 seems small, but a researcher from Action1 thinks the Moderate label underestimates the risk because the attack has already occurred, it only takes one click on an email file, and Outlook is used in almost every organization.

CVE-2026-124194 Summary

How does this loophole work?

When Outlook opens content that points to an outside source (for example a network location), there is usually an external content warning. In this gap, the warning does not appear. According to Microsoft's advisory, unauthenticated attackers send specially designed message files and persuade victims to open them. When opened, Outlook connects to attacker-controlled network locations without the usual warnings, and authentication information may be exposed.

Microsoft explained that what was leaked was the user's NTLMv2 hash, which an attacker could use to authenticate as that user. Jack Bicer from Action1 said the captured hash can be used to log in as a victim, read its data, and move to other accessible systems. Microsoft has not named the perpetrator, and has not detailed how the attack took place in the field. The advisory also does not explain whether the flaw was discovered before or after the exploitation began.

Who is affected?

• Organizations using Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024 with Outlook that has not been updated since Patch Tuesday November 10, 2026.
• Users who often receive attachments or message files from external senders, such as finance, HR and customer service teams.
• Environments that rely on NTLM for authentication, because what is leaked is the NTLMv2 hash.

The product list above follows the SecurityWeek report. See the entry CVE-2026-124194 in the MSRC Update Guide for a complete list of builds and editions.

How do I check my system?

Our open sources do not contain detection commands, indicators of compromise (IOC), nor log rules specific to this vulnerability, so we do not include any commands. Checking steps that can be taken:

1. Go to the CVE-2026-124194 page in the MSRC Update Guide and match your Office edition to the updates listed.
2. Make sure the November 2026 security update is installed on all devices running Outlook, via the device management console (for example Intune or WSUS) or the Office update tool.
3. Check network logs and telemetry for unusual outbound connections from the user's device to the external host after the user opens the message file. This is general practice for hash theft cases, not advisory guidance.

Mitigations and patches

Official patch

1. Install the November 2026 Microsoft security update for Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
2. Prioritize devices used by staff who frequently receive emails from outside.
3. Monitor MSRC for any revisions to the advisory, because currently only version 1 ("Information published") is available.

Temporary mitigation

The Microsoft advisory we read did not list an official workaround. Based on the terms of the attack, the following steps make sense as long as the patch is not installed, but this is a precautionary suggestion and not a replacement for a patch:

1. Remind users not to open message files or Office files from unknown senders.
2. Report to the security team any suspicious message files, especially unexpected ones.

Checklist for today

• Determine which devices use Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024.
• Make sure the November 2026 update is installed, starting with the users who receive external email most frequently.
• Send a quick reminder to employees about message files from unknown senders.
• Have the security team check for anomalous outbound connections from Outlook users' devices.
• Note the KEV deadline of November 24 2026 as a priority reference, even though that deadline is binding on US federal agencies and not companies in Indonesia.

FAQs

Can this loophole be triggered just via the Preview Pane?

No. Microsoft says the Preview Pane is not an attack vector. Users must open malicious message files.

Why does the "Moderate" gap with CVSS 6.5 need to be patched immediately?

Because Microsoft already detected the exploit and CISA included it in KEV. CVSS scores do not reflect the fact that an attack is already underway.

What is an NTLMv2 hash and why is it dangerous if it is leaked?

An NTLMv2 hash is a derivative authentication proof of a user's credentials. According to Microsoft, attackers can use it to authenticate as that user.

Is there a workaround other than patches?

The Microsoft advisory we read did not include a workaround. The only official fix is ​​a security update.

Who did the attack?

Not yet known. Microsoft has not linked the attack to any specific group and has not provided technical details of the exploit in the field.

What is the total number of gaps that Microsoft has patched this month?

Sources differ on the numbers: The Hacker News wrote 1,259, SecurityWeek 1,094, and SANS Internet Storm Center 1,260. This difference is likely due to how CVE is calculated, for example whether third party CVE is included. For Outlook, the important one is CVE-2026-124194.

For examples of discussions of other vulnerabilities exploited and in KEV, also read CVE-2026-97229 on GitLab. If your team is building automation for security reports or notifications, API keys can be generated at console.apipedia.id.

Source

• Microsoft MSRC: data advisory CVE-2026-124194 (primary source)
• The Hacker News: Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
• SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
• SANS Internet Storm Center: Microsoft Patch Tuesday November 2026
• Dark Reading: RSS feed (November Patch Tuesday, November 10, 2026)