🔍 Read the full analysis: Outlook Zero-Day Under Attack: What To Patch Before CISA’s November 24 Deadline on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash when a crafted file is opened. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 deadline for U.S. federal civilian agencies. Microsoft has released fixes; the source material does not provide the complete list of Microsoft 365 Apps builds.
Microsoft Outlook flaw CVE-2026-124194 is under active exploitation, according to Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency. CISA added it to its Known Exploited Vulnerabilities catalog on Nov. 10, requiring U.S. federal civilian agencies to apply the available fix by Nov. 24, 2026; the agency also urges other organizations to prioritize remediation.
Microsoft describes the vulnerability as a spoofing flaw: an attacker can send a specially crafted Office file and persuade a user to open it in an affected version of Outlook. Microsoft says the file can cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. The connection may expose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as that user.
The attack requires a person to open the file, but Microsoft says no attacker account or prior authentication is required. The Preview Pane is not an attack vector, according to Microsoft’s entry. The company rates the vulnerability Moderate, with a CVSS score of 6.5 out of 10; it does not describe the flaw as enabling code execution.
Microsoft says there is no workaround listed and identifies its Office security update as the fix. The source material names fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps are also affected, and Microsoft lists Nov. 10 builds for its servicing channels, but the supplied source text cuts off before giving the complete build list. Administrators should verify the applicable fixed build in Microsoft’s current security guidance rather than rely on an incomplete list.
Outlook zero-day under attack What to patch before November 24
Microsoft confirms active exploitation of an Outlook flaw that can expose a user’s NTLMv2 hash. Apply Microsoft’s update and verify the fixed build for each Office version and channel.
How the exposure happens
A user must open a crafted file in an affected Outlook version; Preview Pane is not an attack vector.
An attacker persuades a user to open a specially crafted Office file.
The app can connect to an attacker-controlled network location without the usual external-content warning.
The NTLMv2 hash could be used to attempt authentication as the affected user.
Who needs to act
CISA recommends prioritizing the patch across organizations; the November 24 directive deadline applies to federal civilian executive branch agencies.
- Apply the available Microsoft update by November 24, 2026.
- Confirm affected installations run fixed builds.
- Prioritize remediation of this KEV-listed flaw.
- Check Microsoft’s current guidance for the applicable release.
Fixed builds named in the guidance
Verify the installed Office build across managed devices.
| Office version | Fixed build |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check Microsoft’s current guidance by channel |
Why Exposed Outlook Accounts Matter
A disclosed NTLMv2 hash can give an attacker a way to attempt authentication as the affected user, potentially creating a foothold in an organization’s environment. The confirmed risk is credential exposure; what an attacker might do afterward depends on the account, network controls and other circumstances. Microsoft says the flaw is being exploited, so organizations should treat the update as a current security priority rather than wait for routine maintenance.
The Nov. 24 date is a binding deadline for federal civilian executive branch agencies under the applicable directive, not a universal legal deadline for private companies or other organizations. CISA nevertheless recommends that all organizations prioritize vulnerabilities in its KEV catalog. The catalog entry marks ransomware use as unknown, so the available information does not establish that this flaw has been used in ransomware campaigns.
Popular right now
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Hot and Cold Milk Frother
As an affiliate, we earn on qualifying purchases.
CISA’s November 10 Listing
CISA added the Outlook vulnerability to its KEV catalog on Nov. 10, 2026, among six vulnerabilities it said were included based on evidence of active exploitation. The catalog entry sets the remediation date at Nov. 24 and directs agencies to apply mitigations according to vendor instructions, or discontinue use of a product if mitigations are unavailable. Microsoft has released an update for this Outlook issue.
CISA says the relevant directive applies only to federal civilian executive branch agencies. Its broader recommendation is that all organizations use risk-based vulnerability management and prioritize KEV-listed flaws. Microsoft labels the Outlook issue Moderate, while its exploitation status—and CISA’s catalog entry—make patching urgent despite that severity rating.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its security guidance for CVE-2026-124194
What Is Still Unknown
The available reporting does not identify who is behind the exploitation, which organizations or users were targeted, how many may have been affected, or when attacks began. It also does not establish whether attackers have successfully used stolen hashes to access accounts or networks. CISA lists ransomware use as unknown.
The source material does not include the full set of Microsoft 365 Apps fixed builds, because its build list is cut off. It also does not provide incident details or independent data on the scale of exploitation. Microsoft and CISA confirm active exploitation, but that does not by itself establish the number or identity of victims.
Patch and Verify Office Builds
Federal civilian agencies should meet CISA’s Nov. 24, 2026 deadline by applying the relevant Microsoft update and confirming that affected installations are running fixed builds. Other organizations should also prioritize the patch, as CISA recommends. IT teams should check Office’s installed build across managed devices and consult Microsoft’s security guidance for the right Microsoft 365 Apps channel and release.
Organizations should follow their incident-response procedures if they have evidence that a malicious file was opened or that account credentials may have been exposed. The supplied sources do not say that CISA requires forensic triage for this particular catalog entry. Further information about attackers, targets and the extent of exploitation remains dependent on disclosures from Microsoft, CISA and affected organizations.
Key Questions
What does Outlook vulnerability CVE-2026-124194 do?
Microsoft says a crafted file opened in an affected version of Outlook can make the app connect to an attacker-controlled network location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
No. Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the malicious file.
Who must meet CISA’s November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the relevant directive. CISA encourages other organizations to prioritize the vulnerability but the cited directive does not make the date mandatory for them.
Which update fixes the Outlook vulnerability?
Microsoft identifies its security update as the fix and lists build 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps also receive fixes; consult Microsoft’s current security guidance for the complete build list by update channel.
Is the flaw linked to ransomware attacks?
The available CISA catalog information lists ransomware use as unknown. That does not confirm a ransomware connection.
Source: ThorstenMeyerAI.com
