Microsoft’s November updates fix an Outlook bug that attackers were using before the patch existed. A user opens a booby-trapped message file, Outlook quietly reaches out to a server the attacker controls, and the user’s Windows sign-in hash goes with it. No warning appears.
Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.
That hash can be cracked offline or relayed straight into another company server as that user. CISA added the bug to its exploited list on Tuesday. The catch for IT teams: the fix ships in the Office update, so a PC that took this month’s Windows patch can still be exposed.
One opened file, no warning, and Outlook hands an attacker your Windows sign-in hash. The fix is in the Office update, not the Windows one.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Outlook leaks Windows password hashes from one opened file
CVE-2026-124194 is listed by Microsoft as an Outlook spoofing flaw, rated Moderate with a CVSS score of 6.5. Microsoft’s advisory marks it “Exploitation Detected” and says it was not publicly disclosed before the fix. The trigger is a crafted message file. Opening it makes Outlook connect to an attacker’s network location “without displaying the usual external-content warning,” which discloses the user’s NTLMv2 hash.
Microsoft says the Preview Pane is not an attack vector: the user has to open the file. It has not said who is behind the attacks or who was targeted. The advisory credits a researcher using the name “nono” and Benoît Sevens.
- Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit).
- Fixed builds listed by Microsoft: Office LTSC 2024 16.0.17932.21140 and Office LTSC 2021 16.0.14334.21048. Microsoft 365 Apps builds are on Microsoft’s Office security release page.
- CISA KEV: added November 10, 2026, federal due date November 24.
Every office running classic Outlook on Windows
Nearly every Windows office runs classic Outlook, and a message file is an easy thing to get someone to open. Rapid7 notes that an NTLMv2 hash can be relayed live to log in as the user wherever SMB or LDAP signing, or Extended Protection for Authentication on Exchange and AD Certificate Services, is not enforced. It can also be cracked offline to recover the password itself.
The CVSS score undersells it. Rapid7 calls the bug useful both to commodity attackers harvesting access at scale and to more targeted campaigns. A finance clerk’s hash relayed to a file server is enough to start an incident.
Push the Office update, not just the Windows one
- Push the November Office security update to every machine with Microsoft 365 Apps or Office LTSC 2021/2024, and confirm the build against Microsoft’s Office security release list. Windows cumulative updates alone do not fix this.
- Block outbound SMB (TCP 445) to the internet at the perimeter firewall, so a leaked connection never leaves the building.
- Add administrators and other high-value accounts to the Protected Users group, which stops NTLM authentication for them.
- Turn on SMB signing and LDAP signing, and Extended Protection for Authentication on Exchange and AD CS, so a stolen hash cannot be relayed.
- While the patch team is in there, schedule the Windows Search fix CVE-2026-116928 on Exchange servers: Rapid7 says one malicious attachment can lead to pre-auth code execution. Our patch priority checklist helps rank the rest of this month’s list.
Forward this
For whoever manages our Windows PCs and Office installs: Microsoft fixed an Outlook bug that attackers are already using to steal Windows sign-in hashes when someone opens a malicious message file. The fix comes in the November Office update, not the Windows one. Can we confirm the Office update is going out to every PC this week, and that outbound port 445 is blocked at the firewall?
Details
- CVE-2026-124194: Microsoft Outlook spoofing (CWE-356, product UI does not warn of unsafe action). CVSS 3.1 6.5, AV:N/PR:N/UI:R. Exploitation Detected; not publicly disclosed. Released November 10, 2026.
- Products: Microsoft 365 Apps for Enterprise; Office LTSC 2024 (fixed 16.0.17932.21140); Office LTSC 2021 (fixed 16.0.14334.21048).
- KEV: added November 10, 2026; federal due date November 24, 2026.
- Also in this release: CVE-2026-116928, Windows Search remote code execution, Critical, CVSS 9.8, fixed in the Windows update; Rapid7 ties it to Exchange processing a malicious attachment. Windows 11 cumulative update KB5132061.
Hunt / verify
- Check firewall and proxy logs for outbound SMB (TCP 445) or WebDAV connections from workstations to internet addresses since late October.
- On domain controllers, review NTLM authentication events (4624 with NTLM V2) for logons from unusual hosts right after a user opened mail.
- Search mail logs for message-file attachments (.msg) from outside senders in recent weeks.
- Use your endpoint management tool to list Office builds still below the fixed version after the rollout.
Source: Microsoft advisory CVE-2026-124194; CISA KEV alert, November 10
Sources
- Microsoft Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability
- Microsoft: Office security release builds
- CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
- Rapid7: Patch Tuesday, November 2026
- BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
- SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
- CyberInsider: Microsoft’s November updates fix 1094 flaws, Outlook zero-day
- Microsoft Security Update Guide: CVE-2026-116928 Windows Search Remote Code Execution
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
