Exploited Outlook zero-day among 1,094 flaws patched by Microsoft
Original title: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
The moderate CVSS 6.5 flaw, CVE-2026-124194, leaks an NTLMv2 hash when a user opens a crafted message file.
Microsoft's November 2026 updates address 1,094 vulnerabilities, including an Outlook spoofing bug the company says attackers have already used. Opening a malicious message file can make Outlook reach an attacker-controlled location without the usual external-content warning. The issue was not public before the fix and cannot be triggered from the Preview Pane. Windows accounts for 726 of the fixes; these are the last updates for Windows 11 version 23H2 Enterprise and Education.
Unconfirmed: Microsoft says the bug was exploited but its advisory gives no details about the attacks.
- Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
- Office had 174 fixes, SQL Server 59, SharePoint Server 27, Azure 20, and Exchange nine.
- Microsoft republished 165 third-party CVEs and says Chrome flaws are not listed.
- Researchers credited are nono and Benoît Sevens; Sevens' note cites Anthropic's Claude.
- Critical updates also cover Windows 10 and 11, Server 2016 through 2025, and Edge.
Impact: Leaks the user's NTLMv2 hash, enabling impersonation
| Product | Affected |
|---|---|
| Microsoft 365 Apps for Enterprise | — |
| Microsoft Office LTSC 2021 | — |
| Microsoft Office LTSC 2024 | — |
- 1.Install Microsoft's November 2026 security updates for affected Outlook and Office products.
- CVEs
- CVE-2026-124194
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
2 min read at securityweek.com
CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.