CISA confirms active exploitation of Outlook spoofing flaw CVE-2026-124194
Original title: CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability
Opening a crafted message file can leak an NTLMv2 hash; Preview Pane is not a vector, and fixes are out.
CISA confirmed attackers are exploiting Microsoft Outlook zero-day CVE-2026-124194, which Microsoft rates as spoofing with CVSS 6.5. A victim who opens a crafted message file can make Outlook connect to an attacker-controlled location without the usual external-content warning, disclosing an NTLMv2 hash usable for impersonation. Microsoft says this is not remote code execution and not a Preview Pane or zero-click issue. CISA added it to KEV on November 10, 2026, with a November 24 remediation deadline.
Unconfirmed: Microsoft marks exploitation as detected but does not name attackers, victims, scale, or indicators.
- Fixed builds are 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.
- Affected editions include Microsoft 365 Apps for Enterprise plus Office LTSC 2021 and 2024, 32-bit and 64-bit.
- CWE-356: Outlook skips user approval before reaching an outside network location.
- The advisory names no attackers, victims, campaign scale, or indicators of compromise.
- Federal agencies must apply mitigations or stop using unfixed products by November 24.
Impact: Leaks the victim's NTLMv2 hash for impersonation
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft 365 Apps for Enterprise | 32-bit and 64-bit editions | — |
| Microsoft Office LTSC 2021 | 32-bit and 64-bit editions | 16.0.14334.21048 |
| Microsoft Office LTSC 2024 | 32-bit and 64-bit editions | 16.0.17932.21140 |
- 1.Install LTSC 2021 build 16.0.14334.21048 or LTSC 2024 build 16.0.17932.21140 and verify build numbers.
- 2.Microsoft 365 admins should use the advisory's Office security release guidance for the correct update.
- 3.Apply vendor mitigations by November 24 or discontinue products that cannot be fixed.
- CVEs
- CVE-2026-124194
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | 2% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability CVE-2026-124194 that can expose user authentication data.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.