Microsoft confirms Outlook zero-day used to steal NTLMv2 hashes
Original title: Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes
Patched November 10, CVE-2026-124194 leaks hashes only after a user opens a crafted file; Preview Pane is not a vector.
Microsoft says attackers are exploiting CVE-2026-124194, a spoofing flaw in Outlook that can disclose a user's NTLMv2 hash. The victim must open a crafted message file; Outlook may then connect to an attacker-controlled location without the usual external-content warning. The issue was patched on November 10, 2026, and was not publicly disclosed before the update. Microsoft rates it CVSS 6.5 and Moderate, with Exploitation Detected.
Unconfirmed: The report does not name the attackers or confirm how stolen hashes were used.
- Fixed builds are 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.
- Microsoft 365 Apps need the November 2026 channel update; no single build is listed.
- Microsoft says previewing a message does not meet exploitation requirements.
- Microsoft recommends blocking outbound SMB on TCP port 445 to the internet.
- Confidentiality impact is High, with no direct integrity or availability impact.
Impact: Theft of the user's NTLMv2 hash for possible authentication as that user
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft 365 Apps for Enterprise | — | November 2026 security update for the deployed update channel |
| Microsoft Office LTSC 2024 | — | 16.0.17932.21140 |
| Microsoft Office LTSC 2021 | — | 16.0.14334.21048 |
- 1.Install the November 2026 Office security updates, including the listed LTSC fixed builds.
- 2.Block unnecessary outbound SMB traffic on TCP port 445 to the internet.
- CVEs
- CVE-2026-124194
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
Microsoft has confirmed that hackers are exploiting an Outlook zero-day that can expose Windows authentication information when a user opens a malicious file. Tracked as CVE-2026-124194, the spoofing vulnerability was patched on November 10, 2026. Microsoft marks it “Exploitation Detected” and says it was not publicly disclosed before the update.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.