Microsoft has announced that a zero-day vulnerability in Outlook is currently being exploited by hackers to steal Windows authentication data when users open malicious files. This vulnerability, identified as CVE-2026-124194, was patched on November 10, 2026. It was not publicly known before the update was released, and Microsoft has categorized it as ‘Exploitation Detected’.
Details of the CVE-2026-124194 Vulnerability
The flaw, which has a CVSS score of 6.5 and is rated as moderately severe, has become a priority for patching due to confirmed exploitation. According to Microsoft’s Exploitability Index, the ‘Exploitation Detected’ status indicates that the company is aware of real-world exploitation, not merely theoretical attacks.
Hackers can exploit this vulnerability without needing an account or prior access to the user’s system. By sending a specially crafted message file, they can trick recipients into opening it with a vulnerable version of Outlook. Successful exploitation requires user interaction and network connectivity, potentially exposing the user’s NTLMv2 hash and allowing attackers to impersonate them.
Impact and Mitigation Strategies
Microsoft clarifies that the Preview Pane does not serve as an attack vector, distinguishing this flaw from other known vulnerabilities. This vulnerability doesn’t directly execute malicious code but poses significant risks of authentication-data theft. The flaw impacts confidentiality, allowing attackers to misuse the user’s authentication data depending on the receiving service’s security measures.
Past incidents, such as those involving compromised Ubiquiti routers, highlight how attackers have used similar vulnerabilities to steal credentials. While these examples suggest potential attack methods, they do not directly link to the current exploitation of the Outlook flaw.
Versions and Security Updates
The affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 editions. Microsoft has released fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Administrators are advised to apply the necessary Office security updates immediately.
To bolster security, Microsoft also suggests blocking unnecessary outbound SMB traffic on TCP port 445 to the internet to curb external SMB exposure. However, this measure should complement rather than replace the installation of the Outlook security fix.
Organizations are encouraged to stay vigilant and integrate threat intelligence into their operations to mitigate the risk of exploitation. Prompt updates and informed security practices are crucial in safeguarding systems against such vulnerabilities.
