Outlook: an exploited flaw leaks users’ NTLMv2 hashes, Microsoft patches it

Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.

Microsoft’s November 2026 updates fix CVE-2026-124194, an Outlook flaw that the vendor says is already exploited. A crafted file opened in Outlook makes it connect to an attacker’s server without the usual warning, handing over the user’s NTLMv2 hash; CISA has added the flaw to its catalogue of exploited vulnerabilities.

What happened

On 10 November 2026, Microsoft released its monthly security updates. According to The Record, they cover 1,093 vulnerabilities, the second month in a row above one thousand. Among them, CVE-2026-124194 in Outlook is marked by Microsoft as already exploited in the wild. The same day, the US agency CISA added it to its Known Exploited Vulnerabilities catalogue and gave federal agencies until 24 November to fix it. Neither Microsoft nor CISA has said who is behind the attacks or who was targeted.

How attackers use it

Microsoft describes the scenario as follows: the attacker sends a crafted file and convinces the user to open it in Outlook. The application then connects to a network location controlled by the attacker without showing the usual warning about external content. In doing so it discloses the user’s NTLMv2 hash, which the attacker can reuse to authenticate as that user. No account is needed on the attacker’s side, but the victim must open the file: the preview pane is not an attack path. Microsoft scores it 6.5 out of 10 and rates it moderate, yet a stolen hash can open the door to other services in the company.

Affected products listed by Microsoft: Microsoft 365 Apps for Enterprise (32 and 64 bit), Office LTSC 2024 and Office LTSC 2021.

What to do now

1. Update Office: build 16.0.17932.21140 or later for Office LTSC 2024, 16.0.14334.21048 or later for Office LTSC 2021; for Microsoft 365 Apps, the November security build of your update channel. Check in Outlook under File > Office Account > About Outlook.
2. Make sure updates actually reach the workstations: Click-to-Run machines sometimes stay on an old build when updates are deferred by policy.
3. Block outbound SMB (TCP 445) to the Internet on the firewall, which cuts the most common route for sending NTLM hashes outside.
4. Place administrator and sensitive accounts in the Protected Users group, which prevents NTLM authentication for them, and plan to reduce NTLM use in the domain.
5. Remind staff not to open unexpected attachments, even from a known sender.

Our take

A flaw rated moderate but already exploited deserves more attention than a critical one nobody uses. Workstation patching is part of server security: a leaked NTLM hash is often the first step towards the file server or the domain controller.

Sources

• Microsoft MSRC — Microsoft Outlook Spoofing Vulnerability (CVE-2026-124194)
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-124194 (Microsoft Office Outlook)
• The Record — Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row

How we choose, verify and write our analyses →