Outlook Zero-Day CVE-2026-124194: How to Patch (Nov 2026)

What is the Outlook zero-day CVE-2026-124194?

CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability that attackers exploited before a fix existed; Microsoft patched it on 10 November 2026 ^[1][2].

Microsoft's Security Update Guide lists the flaw as "Exploitation Detected" and says it was not publicly disclosed before the patch ^[1]. Its weakness type is CWE-356, which means the product does not warn the user before an unsafe action ^[1][6].

In plain terms, Outlook should show a warning before it fetches content from an outside network location. With this bug, a specially crafted message file could make Outlook connect to a server controlled by the attacker without showing that warning ^[1][2].

It was the only actively exploited zero-day in Microsoft's November 2026 release, according to BleepingComputer and SecurityWeek ^[2][3]. Microsoft credited a researcher known as "nono" and Benoît Sevens for reporting it ^[3].

This is a security flaw, not a service outage.

How does the Outlook NTLM hash leak work?

The attacker sends a crafted message file; if the victim opens it in an affected Outlook, Windows may try to sign in to the attacker's server and hand over the user's NTLMv2 hash ^[1][2].

1. Delivery: the attacker emails or otherwise shares a malicious message file ^[1].
2. User action: the victim opens the file in Outlook. Microsoft says the Preview Pane is not an attack vector, so a click to open is needed ^[1].
3. Hidden connection: Outlook connects to an attacker-controlled network location without the usual external-content warning ^[1].
4. Hash sent: Windows automatically tries to authenticate, which exposes the user's NTLMv2 hash ^[1][2].
5. Abuse: the attacker can try to crack the hash offline or use it to authenticate as the user ^[1][2].

NTLM is an older Windows sign-in protocol. A hash is not the password itself, but BleepingComputer says a captured NTLMv2 hash could be cracked offline ^[2], and Microsoft notes that NTLM is open to SMB relay, man-in-the-middle and brute-force attacks ^[9]. BleepingComputer also noted that similar NTLM leak flaws have been exploited before through malicious attachments in phishing campaigns ^[2].

Microsoft's advisory gives no details about who was attacked or how widely ^[3].

Which Outlook versions are affected and what are the fixed builds?

Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected, in both 32-bit and 64-bit editions ^[1][5].

The November 2026 Office security release came out on 10 November and covers each update channel ^[5]. Microsoft lists CVE-2026-124194 under the Outlook section of that release ^[5]. The table below shows the fixed builds as Microsoft lists them for each channel and version. Compare your build with the row that matches your channel and version.

To find your build, open File, then Office Account (or Account) in an Office app; the Product Information section shows the product name and, in some cases, the full version number, and the About button for the app shows the full version ^[10]. To install the update, choose Update Options, then Update Now ^[8]. If Update Options is missing and only an About button appears, your copy is volume licensed or managed by your organisation, so use Microsoft Update or contact your help desk ^[8].

SecurityWeek listed the same three affected products ^[3]. Microsoft's advisory lists only Office products as affected and points to the Office security release notes for the fix, so a Windows cumulative update is not the fix ^[1][5].

How serious is the Outlook zero-day?

Microsoft rates it Moderate, with a CVSS 3.1 base score of 6.5, but it deserves quick action because attacks are already happening ^[1][3][4].

The CVSS vector shows that user interaction is required (the user must open a file), with high confidentiality impact and no integrity or availability impact ^[1].

Three facts raise the practical urgency beyond the score:

• Confirmed exploitation: Microsoft marked it as exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 10 November 2026 ^[1][4].
• Credential theft: Microsoft says the leaked hash could be used to authenticate as the user ^[1], and it notes NTLM is open to relay and brute-force attacks ^[9].
• Phishing delivery: BleepingComputer says similar NTLM flaws were exploited before through malicious attachments in phishing campaigns ^[2].

CISA gave US federal civilian agencies until 24 November 2026 to apply the fix ^[4]. CISA says it is unknown whether ransomware groups have used the flaw ^[4]. JPCERT/CC in Japan also issued an alert urging users to apply the updates ^[6].

How do you protect yourself from CVE-2026-124194?

Install the November 2026 Office update first; Microsoft's advisory lists the update as the fix and gives no separate workaround ^[1][5]. Then consider the general hardening steps below ^[7][9].

1. Update Office: in Outlook choose File, Office Account, Update Options, Update Now, or push the update through your management tools ^[5][8].
2. Confirm the build: compare the build shown in Outlook with Microsoft's list for your channel ^[5].
3. Block outbound SMB: Microsoft's general SMB guidance advises blocking TCP port 445 outbound to the internet at the corporate firewall, and says you are unlikely to need it unless a public cloud offering such as Azure Files or Office 365 requires it ^[7]. This is defence in depth, not a Microsoft-listed workaround for this flaw.
4. Cover laptops: Microsoft recommends outbound firewall rules on laptops for public networks, because they reduce phishing attacks that send users to malicious servers to harvest credentials ^[7].
5. Restrict outgoing NTLM: the Windows policy "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" can audit or deny outgoing NTLM; Microsoft advises selecting Audit all first and reviewing the log ^[9].
6. Be careful with message files: do not open unexpected message attachments, even from known contacts.

Because a captured hash can be cracked offline ^[2], a long, unique password is the better defence. See the Pouyam guide Password Managers Explained: How They Work and Whether They Are Safe.

What should you do if you opened a suspicious message file?

As a general precaution, change the password of the Windows or work account you were signed in with, and tell your IT team so they can check sign-in logs.

Microsoft's advisory says the flaw discloses the user's NTLMv2 hash, which could be used to authenticate as the user ^[1]; it gives no steps for people who may already have opened such a file. A captured hash is derived from the old password, so a new password means that hash no longer matches the account.

• Report it: tell IT or security staff the time you opened the file and who sent it.
• Keep the email: do not delete it; it helps investigators find other recipients.
• Check sign-ins: admins can review account activity for unfamiliar locations or devices.
• Use multi-factor authentication: it makes a cracked password less useful for signing in to online services, although it cannot stop an attacker from trying to crack the hash.

Admins who set the outgoing NTLM policy to audit mode will see attempts logged in the NTLM operational log, which identifies the servers that receive NTLM authentication requests from the device ^[9]. For home users, the steps are simpler: update Office, change your password if you opened a strange file, and turn on two-step sign-in. The Pouyam guide Two-Factor Authentication Explained: Which 2FA Method Is Safest? compares the options.

What else did Microsoft fix in November 2026 Patch Tuesday?

Microsoft's November 2026 release fixed more than 1,000 vulnerabilities, but outlets counted differently: SecurityWeek reported 1,094 and BleepingComputer 1,235 ^[2][3].

Neither outlet explains the gap fully. BleepingComputer says its total excludes 108 flaws fixed earlier in the month ^[2], while SecurityWeek gives a product breakdown and also mentions 165 third-party CVEs that Microsoft republished ^[3]. BleepingComputer said 66 of the flaws were rated Critical ^[2]. SecurityWeek counted 726 Windows flaws and 174 in Office ^[3].

The Outlook bug was the only flaw flagged as exploited ^[1][2][3]. The release also included the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions, SecurityWeek reported ^[3].

October's release was larger, at a record: BleepingComputer reported 1,411 fixes and SecurityWeek 1,413 ^[2][3]. BleepingComputer noted that Microsoft continues to use AI to find and patch vulnerabilities ^[2]. For home users, the practical advice is the same each month: let Windows Update and Office updates install, then restart.

How do Outlook message-file attacks reach people?

Attacks like this usually arrive as phishing: an email with a malicious attachment, as BleepingComputer describes for similar NTLM flaws ^[2].

Microsoft says the attacker must convince the user to open a malicious file ^[1]. That makes ordinary phishing awareness the first line of defence. Watch for unexpected attachments, urgent requests and senders whose address does not match their name.

For a broader checklist, see the Pouyam guide What Is Phishing? How to Recognise Fake Emails, Texts and QR Codes.

Organisations can also filter message-file attachments from outside senders at the mail gateway and warn users when a message comes from outside the company. These steps do not replace the patch, but they cut the number of people who see the file at all.