Outlook CVE-2026-124194: Exploited Spoofing Bug Leaks NTLM Hashes

Microsoft's November 2026 Patch Tuesday carries one Outlook bug that is already being used against real targets. CVE-2026-124194 is a spoofing vulnerability where Outlook connects to an attacker-controlled location without showing the external-content warning you rely on — and in doing so, hands over your NTLMv2 authentication hash. Microsoft rates it only "Moderate" at CVSS 6.5, but it flags it with the label that matters more than any score: Exploitation Detected. A 6.5 that is being exploited beats a 9.8 that is not.

Developing story — first published 19:30 CET (18:30 UTC), November 10, 2026. Updated as Microsoft and CISA publish more.

At a glance

CVE	CVE-2026-124194
Product / affected versions	Microsoft 365 Apps for Enterprise (32-bit · 64-bit); Microsoft Office LTSC 2024; Microsoft Office LTSC 2021
Fixed in	Office LTSC 2024 build 16.0.17932.21140; Office LTSC 2021 build 16.0.14334.21048; Microsoft 365 Apps via the November 10, 2026 Office security releases
CVSS	6.5 Moderate · CVSS 3.1 · scored by Microsoft · AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploited in the wild	Yes — Microsoft ("Exploitation Detected")
CISA KEV	Not listed (catalog version 2026.11.09)
Public PoC	None public as of 2026-11-10
Official advisory	MSRC CVE-2026-124194

What CVE-2026-124194 actually does

The class is old and the fix list keeps reopening it. Outlook renders a message or an Office file and, somewhere in that rendering, is persuaded to reach out to a remote path — a UNC path, a WebDAV URL, a resource on a server the attacker controls. Windows helpfully authenticates that outbound connection with the logged-on user's credentials. What crosses the wire is not a password but an NTLMv2 response: a challenge-response derived from the user's NTLM hash. Capture it and you can either crack it offline or, more dangerous, relay it live to another service that still accepts NTLM — Exchange, LDAP, a file server, an internal web app — and act as that user.

Microsoft's own FAQ for this CVE is unusually direct about the payoff:

This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user.

The vulnerability is classified as CWE-356: Product UI does not Warn User of Unsafe Actions. That is the whole bug in one line: the external-content prompt that normally gives a user the chance to say "no" does not fire, so the leak happens on a single click with nothing on screen to question. Two details from the advisory narrow the scope and are worth stating precisely:

• The Preview Pane is not an attack vector. The victim has to actually open the crafted file, not merely select the message. That is a meaningful mitigation against the pure zero-click case.
• User interaction is required (UI:R): an attacker sends a malicious Office file and convinces the user to open it. It is a phishing-delivered bug, not a wormable one.

If this feels familiar, it should. CVE-2023-23397 — the Outlook reminder bug a state-aligned actor used throughout 2022–2023 — was the same credential-leak mechanic, triggered by a crafted reminder sound path. The industry blocked the specific trigger; the underlying "Outlook will authenticate outbound if you can make it reach out" problem has resurfaced on a different path. CVE-2026-124194 is the 2026 instance, and this time the exploitation flag was on the day the patch shipped.

Who is exposed and how to check

The affected products are the three current Office servicing trains:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit) — the Click-to-Run channel most enterprises run.
• Microsoft Office LTSC 2024 — fixed build 16.0.17932.21140.
• Microsoft Office LTSC 2021 — fixed build 16.0.14334.21048.

Check your installed build from any Office app: File → Account → About Outlook, or query the Click-to-Run version in the registry:

reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport

If the reported build is below the fixed build for your channel, you are exposed.

Remediation

1. Am I affected?

Confirm the Outlook/Office build as above. Any Microsoft 365 Apps, Office LTSC 2024, or Office LTSC 2021 install not yet on the November 10, 2026 security build is affected.

2. Patch — exact fixed versions

Update to Office LTSC 2024 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048, or the current Microsoft 365 Apps security build listed in the Office security releases index for November 2026. Click-to-Run updates apply on next relaunch of Office; force the update rather than waiting for the maintenance window on an actively-exploited bug.

3. Can't patch everyone tonight? Compensating controls

The exploit depends on the client reaching an attacker server and NTLM-authenticating to it. Cut either leg:

• Block outbound SMB at the perimeter. Deny TCP 445 and 139 egress to the internet at the firewall. There is almost never a legitimate reason for a workstation to speak SMB to an arbitrary external host, and this breaks the most common relay path.
• Restrict outbound NTLM. Use the Group Policy setting Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers — set to Audit first to size the blast radius, then Deny all for accounts that have no business authenticating off-network.
• Enforce SMB signing so any captured response cannot be relayed to internal file servers.
• Reinforce the user message: on an exploited phishing bug, the holding control is "do not open unexpected Office attachments," backed by attachment sandboxing at the mail gateway.

4. Hunt for compromise

There is no vendor IOC list for this CVE yet, so hunt on behavior, not hashes:

• Outbound SMB/WebDAV/HTTP authentication to never-before-seen external hosts originating from OUTLOOK.EXE or svchost-brokered WebClient sessions.
• Windows Security event ID 4624/4648 showing NTLM logons to external destinations, and WebClient service starts on hosts where it is normally dormant.
• Correlate to MITRE ATT&CK T1187 Forced Authentication, T1557.001 (LLMNR/NBT-NS poisoning and SMB relay), and follow-on T1550.002 Pass the Hash / T1021 lateral movement if a relay succeeded.

5. Eradicate and verify

If you find evidence an NTLMv2 response left the environment, treat the exposed account's secret as compromised: force a password reset and invalidate active sessions, review what that identity can reach via NTLM, and confirm outbound 445/139 is actually blocked at the edge. Then re-test by sending a benign file that triggers an external fetch and verifying no credential leaves the host — patching is not "done" until the leak path is proven closed, not assumed closed.

What is not known yet

• No NVD record and no CVSS from NIST — as of publication NVD has not ingested CVE-2026-124194; the only score is Microsoft's 6.5.
• Not yet on CISA KEV (catalog 2026.11.09). An actively-exploited Microsoft bug is a strong candidate for a near-term addition with a BOD 26-04 deadline; recheck the catalog.
• No attribution, no IOCs, no public PoC. Microsoft says exploitation is detected but has not published who, how widely, or against whom.
• The exact outbound trigger (which Office file type and which property forces the fetch) has not been disclosed, which is why the perimeter and NTLM controls above matter more than any single file-type block.

Closing the window while the fleet patches

The honest problem with a bug like this is sequencing. You cannot relaunch Office on every endpoint in the hour after Patch Tuesday, and "Exploitation Detected" means the clock is already running. So the first question is not which machine is unpatched — a build scan answers that — but which fix, in which order, actually stops the credential from leaving. That is the job Zero Hunt's AI Remediation Advisor does: it ranks exposure by real exploitability (CISA KEV first, then what this engine proved reachable in your environment, then CVSS, then EPSS), and for CVE-2026-124194 it gives the exact fixed build with a rollout and rollback note plus the compensating control — block outbound 445, restrict outgoing NTLM — for the hosts that cannot update tonight, then re-verifies that the leak path is closed with the same test that demonstrated it. An autonomous AI red team running on-premise on private models, with a human approving every step, means the account hashes it reasons over never leave your appliance.

The second half is detection during the patch gap. A forced-authentication leak is invisible in the application log — the user clicked, Outlook obeyed, nothing warned — but it is loud on the wire: an outbound authentication to a destination the host has never spoken to. Zero Hunt's AI Traffic Analysis runs a deep-learning model with four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting) at multi-gigabit line rate on the appliance GPU, so the anomalous NTLM egress is flagged while it is happening, not in the next morning's SIEM digest. Validating that end to end — does a crafted file actually force a fetch, and what can a relayed hash reach — is exactly what automated penetration testing proves on your installed build, rather than on a version string. It is the same warning-bypass pattern we covered in the Windows Shell Mark-of-the-Web bypass: the UI that was supposed to let the user say "no" never asked. Start the conversation at contact.