CISA lists actively exploited Outlook spoofing flaw CVE-2026-124194
Original title: CISA Warns of Actively Exploited Microsoft Outlook Zero-Day Vulnerability
Opening a crafted message can leak NTLMv2 to an attacker server; LTSC fixes are 16.0.14334.21048 and 16.0.17932.21140, due November 24.
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook spoofing flaw, to the Known Exploited Vulnerabilities catalog on November 10, 2026, with a November 24 remediation deadline. A user who opens a crafted message file can let Outlook contact an attacker-controlled location without the usual external-content warning, exposing NTLMv2 material rather than a plaintext password. Microsoft rates it CVSS 6.5 with user interaction required; it is spoofing, not remote code execution. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
Unconfirmed: Public reporting does not identify the attackers, affected organizations or campaign scale.
- Fixed Office LTSC 2021 build is 16.0.14334.21048; LTSC 2024 is 16.0.17932.21140.
- CWE-356: Outlook fails to warn before the unsafe outbound connection.
- Captured NTLMv2 may enable cracking or relay, depending on protections.
- CISA says mandatory forensic triage is not required.
Impact: Exposure of NTLMv2 authentication material for impersonation
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft 365 Apps for Enterprise | supported 32-bit and x64 | — |
| Microsoft Office LTSC 2021 | supported 32-bit and x64 | 16.0.14334.21048 |
| Microsoft Office LTSC 2024 | supported 32-bit and x64 | 16.0.17932.21140 |
- 1.Install the applicable November updates, including the named LTSC builds.
- 2.Review suspicious message files and unexpected outbound authentication.
- 3.Restrict unnecessary outbound SMB, enforce SMB signing and review NTLM exposure.
- CVEs
- CVE-2026-124194
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | 2% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
The Cybersecurity and Infrastructure Security Agency has added CVE-2026-124194, an actively exploited Microsoft Outlook spoofing vulnerability, to its Known Exploited Vulnerabilities catalog. Added on November 10, 2026, the entry establishes a November 24 remediation deadline. The warning follows disclosures about Outlook authentication theft involving malicious message files and unsafe external connections.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.