🔍 Read the full analysis: Outlook Zero-Day And CISA’s Deadline: Three Patch Planning Tips on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash if the user opens a crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10 and set Nov. 24 as the remediation deadline for U.S. federal civilian agencies. Microsoft lists Office updates as the fix and no workaround.
CISA has added an actively exploited Microsoft Outlook vulnerability, CVE-2026-124194, to its Known Exploited Vulnerabilities catalog and set a Nov. 24, 2026, deadline for U.S. federal civilian agencies to address it. Microsoft says opening a specially crafted file in an affected Outlook version can cause a connection to an attacker-controlled location and expose the user’s NTLMv2 hash; Microsoft lists an Office update as the fix and no workaround.
Microsoft rates CVE-2026-124194, called the Microsoft Outlook Spoofing Vulnerability, as moderate, with a CVSS score of 6.5 out of 10. Its description says an unauthenticated attacker can send a specially crafted file and persuade a user to open it. Outlook may then connect to an attacker-controlled network location without showing its usual external-content warning. Microsoft says the exposed NTLMv2 hash could be used by an attacker to authenticate as the user.
The vulnerability requires a user to open the malicious file; Microsoft says the Preview Pane is not an attack vector. The flaw does not itself provide code execution. Microsoft and CISA classify it as a weakness involving the product interface failing to warn a user about a potentially unsafe action. CISA’s catalog entry says exploitation is active, while listing ransomware use as unknown.
CISA’s Nov. 10 alert added six vulnerabilities to the KEV catalog based on evidence of active exploitation. Its binding remediation directive applies to federal civilian executive branch agencies, which must apply vendor mitigations by Nov. 24 or discontinue use of a product if mitigations are unavailable. Microsoft has released updates. For other organizations, CISA recommends prioritizing KEV vulnerabilities through risk-based vulnerability management, but the federal deadline is not a general legal requirement.
Outlook Zero-Day Patch planning before CISA’s deadline
Microsoft says attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash when they open a crafted file. Microsoft has released Office updates and lists no workaround.
What the flaw can expose
A user must open a specially crafted file; Microsoft says Preview Pane is not an attack vector.
Hash exposure
Outlook may connect to an attacker-controlled location and expose the user’s NTLMv2 hash, which could help an attacker authenticate as that user.
No automatic takeover
The flaw does not itself provide code execution. Microsoft rates it moderate.
Three patch planning tips
Use the applicable update information for each Office edition and channel.
Identify affected Outlook and Office installations, including the Microsoft 365 Apps update channel.
Apply Microsoft’s fix; the source lists no workaround.
Confirm the installed build against Microsoft’s guidance for your product and channel.
Who must meet the deadline?
CISA’s binding directive applies to federal civilian executive branch agencies.
- Apply vendor mitigations by Nov. 24.
- If mitigations are unavailable, discontinue product use.
- The deadline is not a general legal requirement.
- CISA recommends prioritizing KEV vulnerabilities through risk-based vulnerability management.
What remains unclear
Active exploitation is confirmed, but the supplied material leaves key incident details unknown.
- Who is behind the attacks and who has been targeted.
- How many may have been affected or when exploitation began.
- Whether stolen hashes were used to authenticate in specific cases.
- CISA lists ransomware use as unknown.
Why the Outlook Patch Is Urgent
The risk is not that this Outlook flaw automatically takes over a computer. Rather, a successful attempt can disclose a credential-derived NTLMv2 hash that may help an attacker authenticate as the affected user. In a workplace, that could put an account at risk and provide a foothold for further activity, though the source material does not establish that attackers have used this vulnerability to move through networks or access particular systems.
The CISA listing changes the response priority for covered agencies: it puts the vulnerability on a fixed remediation schedule because exploitation has been reported. Other organizations can use the date as a practical signal to review exposure and patch promptly, while recognizing that the directive’s deadline formally applies only to federal civilian agencies. The user interaction requirement and Microsoft’s moderate rating do not negate the significance of confirmed exploitation.
For administrators, the operational point is to check that the installed Office build is fixed, rather than relying on a policy or an assumption that updates have deployed. The source identifies no workaround, so delaying the update leaves no listed alternative mitigation for this issue.
Products Worth Considering
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
As an affiliate, we earn on qualifying purchases.
How CISA Set the Deadline
CISA’s Known Exploited Vulnerabilities catalog tracks vulnerabilities for which the agency cites evidence of exploitation. The Nov. 10 addition placed this Outlook issue alongside five other flaws affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium. The catalog’s required action for the Outlook entry is to apply mitigations according to vendor instructions; it says to discontinue product use if mitigations are unavailable.
The deadline comes from CISA’s federal directive, identified in the alert as BOD 26-04. CISA says that directive applies only to federal civilian executive branch agencies and separately encourages all organizations to prioritize vulnerabilities in the KEV catalog. The source material says the Outlook entry is not marked for forensic triage under the directive. That is distinct from whether exploitation occurred: CISA lists exploitation as active, but does not require that particular additional check for this entry.
Microsoft’s listed fixed versions include Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140. The source also points to Nov. 10 releases for Microsoft 365 Apps channels, with build numbers varying by channel. Administrators should compare their installations with Microsoft’s applicable release information rather than assume one build applies to every deployment.
“The attacker “could use this to authenticate as the user.””
— Microsoft, in its CVE-2026-124194 security entry
What Is Not Yet Known
The available source material does not identify who is behind the attacks, which organizations or individuals have been targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists ransomware use as unknown; that does not establish whether the flaw has or has not been used in ransomware activity.
The reporting also does not provide independent incident data showing the scale or consequences of exploitation. Microsoft and CISA confirm active exploitation, but those statements alone do not reveal whether attackers successfully authenticated with stolen hashes in specific cases. CISA’s entry says forensic triage is not required for this flaw under the cited directive; that designation should not be read as proof that no compromise occurred.
The supplied Microsoft 365 build information is incomplete for some channels, so this article does not list a full set of fixed builds. Organizations should consult Microsoft’s current security update guidance for the exact channel and product edition they use.
Patch Checks Before November 24
Federal civilian agencies must meet CISA’s Nov. 24 deadline by applying Microsoft’s fix or following the directive’s instruction to discontinue use if mitigation is unavailable. Microsoft has shipped updates and lists no workaround, making installation and verification of the applicable fixed build the central response described in the source material.
Other organizations should review whether they run affected Microsoft 365 Apps or Office LTSC versions, identify the update channel in use, deploy the corresponding security update and confirm the installed build afterward. They can treat CISA’s deadline as a prioritization signal, while keeping in mind it is not a binding deadline for private organizations. Further details about targets, attack timing or observed impact may emerge through subsequent advisories or incident reporting; none are established in the source material provided here.
Key Questions
What does CVE-2026-124194 do?
Microsoft says opening a specially crafted file in an affected Outlook version can cause the application to connect to an attacker-controlled network location without its usual warning. That connection can expose the user’s NTLMv2 hash, which Microsoft says could be used to authenticate as the user.
Does the vulnerability affect Outlook’s Preview Pane?
No. Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open a malicious file.
Who must meet CISA’s Nov. 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the directive cited by CISA. CISA recommends that other organizations prioritize KEV vulnerabilities, but the source does not make this deadline binding on them.
Is there a workaround?
The source says Microsoft lists no workaround or mitigation for this flaw. Microsoft identifies Office security updates as the fix, with fixed builds varying by product and Microsoft 365 Apps channel.
Do officials know who is exploiting the flaw?
The source material does not identify the attackers, the targets, the number of affected users or organizations, or when exploitation began. CISA confirms active exploitation, while the catalog lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
