🔍 Read the full analysis: A November 24 Deadline Looms For The Outlook Zero-Day—What To Patch on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft and CISA report active exploitation of CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after the user opens a crafted file. The November 10 Office updates are the fix; U.S. federal civilian agencies must apply mitigations by November 24, while CISA urges other organizations to prioritize the vulnerability.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash when the user opens a specially crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24 deadline for U.S. federal civilian agencies to apply the vendor’s fix.
The vulnerability, which Microsoft calls the Microsoft Outlook Spoofing Vulnerability, can make Outlook connect to an attacker-controlled network location without displaying its usual external-content warning. Microsoft says the connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user. The flaw does not itself run code, and an attack requires a person to open a malicious file.
Microsoft rates the issue Moderate, with a CVSS score of 6.5 out of 10. Its description says the attacker needs no account on the target system but must persuade a user to open the file. Microsoft also says the Preview Pane is not an attack vector. Those details limit the attack path, but do not remove the risk of stolen authentication data, particularly in an organization’s network.
Microsoft lists no workaround or mitigation separate from updating Office. Fixed releases include Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140. Microsoft 365 Apps users should install the November 10 security update for their update channel; listed builds include Current Channel version 2610, build 20527.20196, and several Monthly Enterprise Channel and Semi-Annual Enterprise Channel releases. Administrators should match installed builds against Microsoft’s release information for their channel and product.
Patch the Outlook zero-day before November 24
CVE-2026-124194 is under active exploitation. Microsoft’s November 10 Office updates fix the flaw, which can expose a user’s NTLMv2 hash after they open a crafted file.
How the attack works
The documented attack path requires a person to open a specially crafted file.
Outlook may connect to an attacker-controlled network location without its usual external-content warning.
Microsoft says the user’s NTLMv2 hash could be used by an attacker to authenticate as that user.
Who needs to act
The November 24 deadline has different force depending on the organization.
- Must apply the vendor’s fix by November 24, 2026, under BOD 26-04.
- Check Office installations against Microsoft’s fixed-version guidance.
- CISA recommends prioritizing vulnerabilities in its KEV catalog.
- Review affected Office products and deploy the applicable update.
Find the right Office update
Build numbers vary by product and Microsoft 365 Apps update channel.
Fixed build
Microsoft lists build 16.0.14334.21048 as fixed.
Fixed build
Microsoft lists build 16.0.17932.21140 as fixed.
Match your channel
Install the November 10 security update and check Microsoft’s release guidance for your channel.
What remains unclear
Active exploitation is reported, but the available information does not identify the attackers, targets, number of affected users, or when exploitation began.
- CISA lists ransomware use as unknown.
- Its forensic triage designation does not establish whether users have been affected.
A Stolen Hash Can Expose Accounts
The concern is not that opening the file automatically gives an attacker control of a computer. Rather, the flaw can disclose a credential hash that Microsoft says could be used to authenticate as the user. That creates a potential route from a targeted message to unauthorized access, depending on the account and the protections around it.
CISA’s catalog entry says exploitation is active, but rates the issue as not automatable and its technical impact as partial. The source article interprets those ratings as pointing toward attacks that require a person to open a file, rather than a worm-like spread. That is an interpretation of the scoring, not a confirmed account of how attackers are using the flaw. For organizations, the immediate practical point is that the fix is available and the vulnerability has been reported as exploited.
The November 24 date has different force for different readers. It is a binding remediation deadline for federal civilian executive branch agencies under the applicable directive. For other organizations, it is not a legal deadline under that directive, but CISA recommends prioritizing vulnerabilities in its KEV catalog.
Products Worth Considering
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
As an affiliate, we earn on qualifying purchases.
From Microsoft Update to CISA Deadline
Microsoft’s November security release identified CVE-2026-124194 as the only flaw in that release marked “Exploitation Detected,” according to the source material. On November 10, CISA added it to the KEV catalog among six vulnerabilities from multiple vendors, citing evidence of active exploitation. The catalog entry directs covered agencies to apply mitigations in line with vendor instructions, or discontinue use of a product if mitigations are unavailable.
CISA says the directive, BOD 26-04, applies only to federal civilian executive branch agencies. It separately encourages all organizations to use risk-based vulnerability management and prioritize KEV vulnerabilities. For this Outlook issue, Microsoft has issued the updates, so the recommended action is to patch rather than rely on a workaround.
The issue is categorized as a product interface failing to warn a user about an unsafe action. Microsoft says Outlook may connect to an attacker-controlled location without its usual warning when the crafted file is opened. The reported exposure depends on that user action; simply viewing the file in the Preview Pane is not identified by Microsoft as an attack path.
““An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.””
— Microsoft, in its CVE-2026-124194 security entry
Attackers and Targets Remain Unknown
The available information does not identify who is behind the attacks, which people or organizations have been targeted, how many systems or users may be affected, or when exploitation began. The source material also reports that CISA lists use in ransomware campaigns as unknown. Active exploitation is confirmed in the cited entries, but those details about the incidents are not established.
CISA’s record does not mark the flaw for forensic triage under the directive’s additional check for prior compromise. That status should not be read as proof that no users have been affected; it describes the catalog’s triage designation. The scope and outcomes of any exploitation remain unclear.
Check Office Builds Before November 24
Covered federal civilian agencies must meet the November 24, 2026 deadline by applying Microsoft’s update in accordance with vendor instructions. Other organizations should review whether they use affected Microsoft 365 Apps or Office LTSC releases, check the installed build against Microsoft’s fixed-version guidance, and deploy the applicable November 10 update.
Microsoft identifies affected products as Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, including 32-bit and 64-bit editions. Microsoft 365 Apps builds vary by channel, so teams should use the release listing for their channel rather than assume one build number covers every installation. The cited source provides some channel-specific builds but its list is incomplete; administrators should consult Microsoft’s full update entry for the applicable release.
Further information that would clarify the threat includes Microsoft or CISA updates on observed attack activity, affected targets, and the period of exploitation. For now, the available guidance is to patch with the relevant Office update; no separate workaround is listed.
Key Questions
What does the Outlook vulnerability do?
CVE-2026-124194 can cause Outlook to connect to an attacker-controlled network location without the usual warning after a user opens a crafted file. Microsoft says this can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user.
Does opening a file in Outlook’s Preview Pane trigger the flaw?
Microsoft says the Preview Pane is not an attack vector. Its description says a user must be convinced to open the specially crafted file for the attack path it documents.
Who must patch by November 24?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s BOD 26-04 directive. CISA encourages other organizations to prioritize KEV vulnerabilities, but the cited directive does not impose this deadline on them.
Which Office update fixes the vulnerability?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed. Microsoft 365 Apps users should install the November 10 update for their specific channel and verify the installed build against Microsoft’s release guidance.
Is there a workaround, and do we know who was attacked?
The source material says Microsoft lists no workaround; the update is the fix. The available information does not identify the attackers, targeted organizations, number of victims, or when exploitation began.
Source: ThorstenMeyerAI.com
