Patched Outlook flaw CVE-2026-124194 leaks NTLMv2 hashes in attacks
Original title: Microsoft Outlook Zero-Day Vulnerability Actively Exploited to Steal NTLM Authentication Hashes
Opening a crafted message can leak an NTLMv2 hash without the usual external-content warning; it is not zero-click.
Microsoft patched CVE-2026-124194, a spoofing flaw in Outlook that attackers are exploiting to obtain NTLMv2 authentication hashes. An unauthenticated attacker sends a crafted message file; if the recipient opens it, Outlook may connect to an attacker-controlled location and disclose the hash. Microsoft rates maximum severity Moderate, with a CVSS 3.1 base score of 6.5. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
Unconfirmed: How many victims were hit, and whether hashes were cracked or relayed, is not stated.
- The patch was released on November 10, 2026.
- Office LTSC 2021 is fixed in 16.0.14334.21048.
- Office LTSC 2024 is fixed in 16.0.17932.21140.
- Microsoft maps the flaw to CWE-356, a missing unsafe-action warning.
- Captured hashes may support offline cracking or relay, not a plaintext password.
Impact: Disclosure of the user’s NTLMv2 hash
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft 365 Apps for Enterprise | — | — |
| Microsoft Office LTSC 2021 | — | 16.0.14334.21048 |
| Microsoft Office LTSC 2024 | — | 16.0.17932.21140 |
- 1.Install the applicable Office updates, including the named LTSC builds.
- 2.Investigate unexpected external authentication attempts and suspicious message files.
- 3.Block unnecessary outbound SMB, enforce SMB signing, and review NTLM exposure.
- CVEs
- CVE-2026-124194
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
Microsoft has patched an actively exploited Outlook zero-day that lets attackers steal Windows authentication information through a malicious message file. Tracked as CVE-2026-124194, the spoofing vulnerability was released on November 10, 2026. Microsoft, the assigning CNA, rates its maximum severity as Moderate, despite confirmed attacks targeting the flaw.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.