🔍 Read the full analysis: Outlook Zero-Day: Key Patches To Apply Before November 24 on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are actively exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after they open a crafted file. CISA added it to its Known Exploited Vulnerabilities catalog and set November 24, 2026, as the deadline for U.S. federal civilian agencies to apply the available Office updates.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 authentication hash when the user opens a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, setting a November 24 deadline for U.S. federal civilian agencies to apply the available Office updates.
Microsoft describes the vulnerability as a spoofing flaw in which an unauthenticated attacker sends a malicious Office file and persuades a user to open it in an affected version of Outlook. Outlook can then connect to an attacker-controlled network location without displaying its usual external-content warning. Microsoft says that connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user.
The flaw requires user action: opening the file. Microsoft says the Preview Pane is not an attack vector. The vulnerability does not itself let an attacker run code, and Microsoft’s rating is Moderate, with a CVSS score of 6.5 out of 10. Those details limit what can be concluded about the impact, but they do not change Microsoft’s and CISA’s confirmation that exploitation is underway.
Microsoft lists affected products as Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Its listed fixed builds include Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140. For Microsoft 365 Apps, the November 10 security release lists updates across servicing channels, including Current Channel Version 2610, build 20527.20196, and several Monthly and Semi-Annual Enterprise Channel builds. Administrators should match the installed product and channel against Microsoft’s release information rather than assume one build applies to every installation.
Outlook Zero-Day Patch Before November 24
Microsoft confirms active exploitation of an Outlook flaw that can expose a user’s NTLMv2 hash. The deadline applies to U.S. federal civilian agencies; other organizations should use it as a prompt to check their Office deployments.
How the attack works
A user must open a specially crafted file in an affected version of Outlook.
The attacker persuades a user to open a malicious Office file.
It can connect to an attacker-controlled network location without its usual external-content warning.
The NTLMv2 hash could give an attacker a way to authenticate as that user.
What the rating leaves out
Severity is only part of the picture for organizations deciding how quickly to respond.
- User action is required: opening the file.
- The Preview Pane is not an attack vector.
- The flaw does not itself run code.
- Microsoft and CISA confirm exploitation is underway.
- A disclosed hash may enable authentication as the affected user.
- Further access depends on account permissions and network protections.
Check the right Office update
Fixed builds vary by product and Microsoft 365 Apps servicing channel.
| Product | Fixed build listed | Admin action |
|---|---|---|
| Office LTSC 2021 | 16.0.14334.21048 | Match the installed product to Microsoft’s release information. |
| Office LTSC 2024 | 16.0.17932.21140 | Verify the system reached its applicable fixed build. |
| Microsoft 365 Apps | Varies by servicing channel | Check the current security release for the installed channel. |
Who must meet the deadline?
CISA’s directive applies to federal civilian executive branch agencies.
Apply the vendor update
Agencies covered by the directive must apply mitigations by November 24, 2026. Microsoft has shipped updates.
Prioritize and verify
The deadline is not binding for other organizations. CISA recommends prioritizing KEV vulnerabilities through risk-based vulnerability management.
Why the Outlook Hash Exposure Matters
A disclosed NTLMv2 hash may give an attacker a way to authenticate as the affected user, according to Microsoft. That makes the flaw relevant beyond a single Outlook message: in an organization, compromised credentials can create opportunities for further access, depending on the account’s permissions and the network’s protections. The source material does not establish that every exposed hash leads to a successful login or further compromise.
The two-week federal deadline reflects CISA’s response to evidence of active exploitation, not a universal legal requirement. CISA’s directive applies to federal civilian executive branch agencies. The agency encourages other organizations to prioritize vulnerabilities in its KEV catalog, making the date a useful prompt for private-sector IT teams to check their Office deployments and patch status.
The vulnerability’s Moderate rating should be read alongside the exploitation notice, not instead of it. A required user action and the absence of code execution may limit some attack paths, while the missing warning and potential credential exposure remain material risks. For organizations, identifying affected installations and confirming that updates have actually been applied are more useful than relying on severity alone.
Products Worth Considering
Ledger Nano X Bluetooth Crypto Wallet
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and 12MP Center Stage Camera (2026, Silver)
Logitech MX Master 3S Bluetooth Wireless Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How CISA Set the November Deadline
CISA’s November 10 notice added six vulnerabilities to its KEV catalog, citing evidence of active exploitation. The other entries named in the source concern products from Cisco, Barracuda Networks, Openwave and Google Chromium. The Outlook entry identifies the issue as a missing user interaction warning for a potentially unsafe action and gives agencies a November 24 due date.
For agencies covered by the directive, the required action is to apply mitigations according to the vendor’s instructions; if mitigations are unavailable, the directive says agencies should discontinue use of the product. In this case, Microsoft has shipped updates. CISA’s directive, BOD 26-04, applies only to federal civilian executive branch agencies. Other organizations are not bound by that deadline, though CISA advises all organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.
Microsoft classifies the issue as CVE-2026-124194 and rates it Moderate. CISA’s catalog records exploitation as active and automatable exploitation as no. The source article interprets that combination as more consistent with attacks requiring targeted user interaction than with a self-spreading worm; that is an interpretation, not a conclusion attributed to CISA.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 security entry
What Is Not Known About Attacks
The available information does not identify who is behind the attacks, which people or organizations were targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists use in ransomware campaigns as unknown, so the evidence provided does not establish a connection to ransomware.
CISA’s entry does not mark this vulnerability for forensic triage under the directive’s field, according to the source material. That status should not be read as proof that no system was compromised. The sources provided do not say how many organizations have installed the fixes, whether attackers have successfully used stolen hashes in particular cases, or whether additional affected products will be identified.
The source material gives only part of Microsoft’s Microsoft 365 Apps build list, so it does not support a complete channel-by-channel inventory here. Administrators should consult Microsoft’s current security release for the precise fixed build for each installed channel.
Check Builds Before November 24
Federal civilian agencies face the November 24, 2026, deadline to apply the vendor updates under CISA’s directive. IT teams should inventory affected Outlook and Office installations, confirm the installed product and update channel, and verify that each system has reached the applicable fixed build. Microsoft’s entry lists no workaround or mitigation; the update is the stated fix.
Organizations outside the federal civilian branch do not have the same binding deadline under this directive. CISA’s recommendation is to prioritize the flaw as part of risk-based vulnerability management. Microsoft and CISA may publish additional information as investigations and remediation proceed, but the source material does not give a further announcement date or a public account of affected victims.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a crafted file opened in an affected version of Outlook can cause the application to connect to an attacker-controlled network location without its usual warning. That connection can disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
Does opening Outlook’s Preview Pane trigger the flaw?
No. Microsoft says the Preview Pane is not an attack vector. Its description says the user must be persuaded to open a specially crafted file.
Who has to patch by November 24?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize the vulnerability, but the source material does not make the federal deadline binding on them.
Which Office updates fix the vulnerability?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140, along with November 10 updates for Microsoft 365 Apps channels. Because Microsoft 365 build numbers differ by channel, administrators should check Microsoft’s release information for the version that matches their installation.
Is there a workaround if an organization cannot update?
The source material says Microsoft’s entry lists no workaround or mitigation; the update is the fix. CISA’s directive says covered agencies should discontinue use of a product if mitigations are unavailable, but Microsoft has shipped updates for this flaw.
Source: ThorstenMeyerAI.com
