CVE-2026-124194 is an actively exploited zero-day in classic Microsoft Outlook. Opening a single crafted message file can make Outlook connect to an attacker’s server and leak the user’s Windows login (an NTLMv2 hash) with no warning. Microsoft fixed it in the November 2026 Patch Tuesday, but the fix ships in the Office updates, so a Windows update on its own does not protect you.
Watch the full breakdown first, or read on for the written guide.
What happened
Microsoft’s November 2026 Patch Tuesday addressed more than a thousand vulnerabilities. Only one of them was confirmed as exploited in the wild at release: CVE-2026-124194, a spoofing flaw in Outlook that gets around the warning users would normally see before Outlook reaches out to a remote server.
On 10 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalogue, giving US federal agencies until 24 November 2026 to patch. When CISA sets a deadline like that, it is a strong signal that every organisation should treat the bug as urgent.
How the attack works
The attack is simple from the victim’s side, which is what makes it dangerous:
- An attacker sends a crafted message file (for example a .msg attachment).
- The user opens it in classic Outlook.
- Outlook silently connects to a server the attacker controls and, in doing so, sends the user’s NTLMv2 hash: a scrambled form of their Windows login.
- The attacker can try to crack that hash offline to recover the password, or relay it to other systems to sign in as the user without ever knowing the password.
No warning prompt appears, because the bug is precisely a bypass of that warning.
Who is affected
Microsoft lists classic Outlook in Microsoft 365 Apps for enterprise, Office LTSC 2021 and Office LTSC 2024. If your staff use the desktop Outlook app that comes with Microsoft 365 or Office, assume you are in scope until you have confirmed the update is installed.
Why a “medium” score is misleading
The vulnerability is rated CVSS 6.5, which falls in the “medium” band. Many patch programmes prioritise by score, so a 6.5 can sit in the queue behind dozens of higher-rated bugs. That is the wrong call here: an exploited medium-severity bug is a bigger real-world risk than an unexploited critical one.
Outlook has been here before. CVE-2023-23397, rated 9.8, leaked NTLM hashes in a similar way and was exploited by Russia-based actors, and the 2024 MonikerLink bug (CVE-2024-21413, also 9.8) abused Outlook’s handling of links. Stolen NTLM hashes remain one of the most reliable ways attackers move from one inbox to a whole network.
What to do now
Work through these in order:
- Update Office itself. In Outlook go to File › Office Account › Update Options › Update Now, or push the Microsoft 365 Apps / Office update through your management tools. Then confirm every device actually installed it: one unpatched desktop is enough.
- Block outbound SMB (TCP port 445) at your firewall and on every endpoint. This is also the workaround if you cannot patch today, because it stops the hash from leaving your network.
- Make stolen hashes useless. Turn on SMB signing and LDAP signing, and enable Extended Protection for Authentication (EPA) on Exchange and AD CS so a captured hash cannot be relayed.
- Shrink your NTLM footprint. Find the accounts and applications that still rely on NTLM and move them to Kerberos where you can.
- Watch message-file attachments. Filter or flag .msg files arriving from outside your organisation, and ask staff to give them a second look.
FAQ
Does the Windows update fix CVE-2026-124194?
No. The fix ships in the Office and Microsoft 365 Apps updates. Check the Office build on each device, not just the Windows update status.
Is new Outlook or Outlook on the web affected?
Microsoft’s advisory lists classic Outlook in Microsoft 365 Apps and Office LTSC 2021/2024. Check the advisory for your exact product and version.
What if we can’t patch straight away?
Block outbound TCP port 445 at the firewall and on endpoints. That stops Outlook from sending the hash to an external server while you roll out the update.
Watch the 60-second version
How Catharsis can help
Catharsis Cyber Security is an ISO 27001:2022-certified MSP/MSSP helping businesses stay secure. We track actively exploited vulnerabilities like this one, patch every Office install across your business, and close the network paths attackers use to steal and relay logins. See our vulnerability management service or talk to us.
