🔍 Read the full analysis: Outlook Zero-Day: Responding To Attacks Before CISA’s Deadline on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft and CISA report active exploitation of CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after they open a malicious file. Federal civilian agencies must apply the vendor fix by Nov. 24, 2026; the deadline is not binding on other organizations, which CISA still urges to prioritize the vulnerability.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash when the user opens a malicious file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026, requiring U.S. federal civilian agencies to apply the available fix by Nov. 24.
Microsoft describes the issue as a weakness that can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. The connection can disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as that user. The attack requires a person to open a crafted file; Microsoft says the Preview Pane is not an attack vector.
Microsoft rates the flaw, identified as the Microsoft Outlook Spoofing Vulnerability, as moderate, with a CVSS score of 6.5 out of 10. Its entry says exploitation has been detected, while CISA added the vulnerability to its catalog based on evidence of active exploitation. Those records establish that exploitation is occurring, but do not identify the attackers or affected organizations.
Microsoft lists Office LTSC 2021 and 2024 and Microsoft 365 Apps for Enterprise among the affected products. Its listed fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft also lists November 10 updates for Microsoft 365 Apps channels. The source material does not provide the complete build list for every channel, so administrators should check Microsoft’s security update guidance for the applicable version.
Outlook Zero-Day Responding Before CISA’s Deadline
Microsoft and CISA report active exploitation of an Outlook flaw that can expose a user’s NTLMv2 hash. A person must open a malicious file for the described attack to occur.
How the exposure happens
The attack requires a recipient to open a crafted file in an affected Outlook version.
The user must open the crafted file; Microsoft says Preview Pane is not an attack vector.
It can connect to an attacker-controlled network location without the usual warning.
Microsoft says an attacker could use the NTLMv2 hash to authenticate as the user.
Who must act by the deadline?
CISA’s binding directive has a specific scope.
- Must apply the vendor fix by Nov. 24, 2026.
- Identify affected Outlook installations and verify fixed builds.
- The federal deadline is not binding on them.
- CISA still urges prioritizing KEV-listed vulnerabilities.
Patch the affected Office version
Microsoft lists updates as the remedy and no workaround for this issue.
| Product | Listed fixed build or guidance |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | November 10 updates; check the applicable channel |
What the Hash Exposure Means
The flaw matters because the exposed hash is tied to a user’s identity. Microsoft says an attacker could use it to authenticate as that user; in a workplace, that may create a path to further access, depending on the account and network protections in place. The available information does not establish that every exposed hash can be used successfully or that attackers have accessed particular systems.
The required user action limits the attack compared with a vulnerability that spreads without interaction, but it does not remove the risk. Microsoft says an attacker must send a malicious file and persuade the recipient to open it. CISA’s record classifies exploitation as active and automatable as no. The source article interprets those details as pointing toward targeted messages rather than a rapidly spreading worm; that is an assessment, not a confirmed description of attacker behavior.
The Nov. 24 date has a specific legal and operational scope. CISA says its binding directive applies to federal civilian executive branch agencies. For other organizations, the date is not a federal mandate, though CISA recommends prioritizing vulnerabilities listed in its catalog. Affected organizations should check installed Office builds and deploy the applicable update, rather than assume that an update policy has already installed it.
Products Worth Considering
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
DJI Mini 5 Pro Fly More Combo with DJI RC 2
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
How CISA Set the Deadline
CISA’s Nov. 10 alert added six vulnerabilities to the KEV catalog based on evidence of active exploitation. The Outlook entry names the issue as a vulnerability involving missing user interaction for a potentially unsafe action. The catalog instructs covered agencies to apply mitigations in accordance with vendor instructions and to discontinue use of a product if mitigations are unavailable. Microsoft has released an update for this flaw.
CISA’s directive sets the Nov. 24 due date for federal civilian executive branch agencies, not private companies, state governments or the general public. The agency separately encourages all organizations to use risk-based vulnerability management and prioritize KEV-listed flaws. Microsoft lists no workaround or mitigation for this Outlook issue; its update is the remedy described in the source material.
Microsoft classifies the flaw as moderate and says opening a crafted file is necessary. It also states that the Preview Pane is not an attack vector. These details help define the reported exposure, but they do not indicate how many attacks have occurred or how successful they have been.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its security guidance for CVE-2026-124194
Who Is Being Targeted
The available records do not identify who is behind the attacks, when exploitation began, which organizations or users were targeted, or how many systems may have been affected. CISA lists ransomware use as unknown. The source material also says the flaw is not marked for forensic triage under the relevant directive; that does not establish that no compromise has occurred.
Microsoft and CISA confirm active exploitation, but the information provided does not detail attack campaigns, success rates, or whether exposed hashes have been used to access accounts. Nor does it establish the broader impact on any particular organization. Those points remain open and should not be inferred from the catalog listing alone.
Patch Checks Before November 24
Federal civilian agencies are required to meet CISA’s Nov. 24, 2026 deadline. Their IT teams should identify affected Outlook installations, verify that systems have the relevant fixed build, and follow Microsoft’s instructions for the Office version and update channel in use. Microsoft 365 Apps builds vary by channel, so administrators should consult the vendor’s current release listing rather than rely on a single build number.
Other organizations can use the same steps as a risk-based response. CISA encourages them to prioritize KEV-listed flaws, and Microsoft lists no workaround for this vulnerability. Further information about the scope of exploitation, affected targets and any attacker activity after patching may emerge, but the supplied material gives no date for additional findings.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a crafted file opened in an affected version of Outlook can cause a connection to an attacker-controlled network location without the usual warning. That connection can expose the user’s NTLMv2 hash, which Microsoft says could be used to authenticate as the user.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its description says a user must open the malicious file for the described attack to occur.
Who must meet CISA’s Nov. 24 deadline?
The binding deadline applies to U.S. federal civilian executive branch agencies. CISA encourages other organizations to prioritize KEV vulnerabilities, but the source material does not make the federal deadline binding on them.
What is the fix?
Microsoft lists Office updates as the fix and provides fixed builds for Office LTSC 2021 and 2024, as well as updates for Microsoft 365 Apps channels. It lists no workaround; administrators should verify the correct build for each installed product and channel against Microsoft’s guidance.
What is not known about the attacks?
The source material does not identify the attackers, targets, start date or number of affected users or systems. CISA also lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
