Microsoft Patch Tuesday fixes Outlook flaw already under attack
Opening a crafted Outlook message can leak an NTLMv2 hash via CVE-2026-124194; a separate Windows Search RCE is not reported as exploited.
Stories per day · 30 days
3 RSS
Relatedmicrosoft13outlook13patch-tuesday11exchange5zero-day5windows4credential-theft2ldap2office2sap2active-directory1apt281authentication1blockntlmsso1credential-guard1incomplete-patch1kev1microsoft-office1
18 stories, newest first · one card per story
Stories tagged #ntlm
Microsoft fixes 1235 flaws, including exploited Outlook zero-day
CVE-2026-124194 can leak NTLMv2 hashes from Microsoft 365 Apps and Office LTSC 2021 and 2024 after one opened message file.
Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
Microsoft patches 1,259 flaws, including exploited Outlook bug
Opening a crafted message can leak an NTLMv2 hash without Outlook’s usual warning.
Patched Outlook flaw CVE-2026-124194 leaks NTLMv2 hashes in attacks
Opening a crafted message can leak an NTLMv2 hash without the usual external-content warning; it is not zero-click.
November Patch Tuesday fixes exploited Outlook NTLM hash-theft flaw
Attackers already use CVE-2026-124194, CVSS 6.5, which leaks an NTLMv2 hash after a user opens a malicious Office file.
2
Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
Microsoft November patches include exploited Outlook flaw CVE-2026-124194
The release covers 1,093 flaws, 63 rated critical, plus Exchange, SharePoint, Windows Search, and LDAP bugs.
November Patch Tuesday fixes 1,235 flaws and an Outlook zero-day
Opening a crafted Outlook message can leak an NTLMv2 hash to an attacker-controlled share.
1
Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
1
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
1
Networking problems after the October 2026 Windows update? NTLM might be to blame
October 2026 Windows update blocks NTLMv1 single sign-on by default, which can break Wi-Fi, Ethernet, and VPN logins.
[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
ZDI-26-732: Foxit PDF Reader importIcon NTLM Response Information Disclosure Vulnerability
ZDI disclosed an NTLM response leak in Foxit PDF Reader importIcon, tracked as CVE-2026-91796.
CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to remote code execution in NTLM authentication client (revised fetchmail-SA-2026-01)
Some fetchmail 6.6.6 and older builds may allow RCE via an NTLM stack overflow.
ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability
ZDI advisory ZDI-26-605 details an improper input validation flaw (CVE-2026-50508, CVSS 3.3) in Microsoft Windows localized filenames that leaks NTLM responses.
xHunt Campaign: New Watering Hole Identified for Credential Harvesting
Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.
2