🔍 Read the full analysis: Outlook Zero-Day Response: 5 Steps To Take Before November 24 on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash when a crafted file is opened. CISA set a November 24 patch deadline for U.S. federal civilian agencies; Microsoft lists Office updates as the fix and no workaround.
Microsoft says attackers are exploiting a vulnerability in Outlook that can expose a user’s NTLMv2 hash if the user opens a specially crafted file. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10 and set November 24, 2026, as the remediation deadline for U.S. federal civilian agencies. Microsoft lists Office updates as the fix and no workaround.
Microsoft identifies the issue as the Microsoft Outlook Spoofing Vulnerability and rates it “Moderate,” with a CVSS score of 6.5 out of 10. Its security guidance says an attacker can send a crafted message file and persuade a user to open it. Outlook may then connect to an attacker-controlled network location without the usual external-content warning, potentially disclosing the user’s NTLMv2 hash. Microsoft says an attacker could use that hash to authenticate as the user.
The attack requires a user to open the file, but Microsoft says the Preview Pane is not an attack vector. The vulnerability does not, according to the supplied security guidance, allow code execution. Microsoft lists affected products as Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions.
Microsoft lists fixed builds for Office LTSC 2021 and 2024 as 16.0.14334.21048 and 16.0.17932.21140, respectively. For Microsoft 365 Apps, the source material identifies November 10 updates including Current Channel Version 2610, Build 20527.20196; Monthly Enterprise Channel Version 2610, Build 20527.20194, Version 2609, Build 20430.20264, and Version 2608, Build 20326.20320; and Semi-Annual Enterprise Channel Version 2610, Build 20527.20192. Administrators should check Microsoft’s current release guidance for the applicable channel and build before determining whether a device is patched.
Outlook Zero-Day Response Five steps before November 24
Microsoft says attackers are exploiting an Outlook flaw that may expose a user’s NTLMv2 hash. Apply the relevant Office update; Microsoft lists no workaround.
What the flaw can expose
A user must open a crafted file; the Preview Pane is not an attack vector.
NTLMv2 hash exposure
Outlook may connect to an attacker-controlled network location without its usual warning. Microsoft says the hash could be used to authenticate as the user.
Affected Office products
Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 are listed as affected, in both 32-bit and 64-bit editions.
Five checks before the deadline
Use Microsoft’s current release guidance to confirm the right build for each device and update channel.
Check whether managed devices run a listed Outlook product.
Compare each device’s Office build with Microsoft’s applicable release guidance.
Microsoft lists updates as the fix and provides no workaround.
Confirm updates reached managed devices; do not rely only on policy or deployment status.
Federal civilian agencies must meet CISA’s deadline. Other organizations are urged to prioritize the flaw.
Deadline and responsibility
CISA added the actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on November 10, 2026.
- Meet the November 24, 2026 remediation deadline.
- Apply mitigations in line with vendor instructions, or discontinue use if mitigations are unavailable.
- The cited directive does not make the date a universal legal deadline.
- CISA encourages risk-based prioritization of KEV-listed vulnerabilities.
Why the Outlook Hash Exposure Matters
The flaw matters because it can expose a credential-related value without the warning a user might normally expect when Outlook connects to an external location. Microsoft says the disclosed NTLMv2 hash could be used to authenticate as the user. In workplace environments, that creates a risk beyond the initial email: a compromised identity may give an attacker a route to pursue further access, depending on the account and network protections in place.
CISA’s listing confirms that the agency considers the vulnerability actively exploited, but it does not establish how many people or organizations have been affected. CISA’s catalog records ransomware use as unknown, and its entry does not designate this flaw for forensic triage under the relevant directive. The listing also rates exploitation as active and automatable as no. Those classifications should not be taken as proof that an individual organization has or has not been targeted.
The November 24 date is a binding deadline for the federal civilian executive branch, not a universal legal deadline for private organizations. CISA nevertheless urges all organizations to prioritize vulnerabilities in the KEV catalog. For other Outlook users, the date is a useful prompt to check installed builds and apply the relevant update.
Popular right now
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Roborock Qrevo S Pro Robot Vacuum and Mop, 18,500 Pa Suction
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
As an affiliate, we earn on qualifying purchases.
How CISA Set the November Deadline
CISA added the Outlook flaw to its KEV catalog on November 10, 2026, in an alert covering six vulnerabilities across several vendors. The agency said the additions were based on evidence of active exploitation. The Outlook listing gives federal civilian agencies until November 24 to apply mitigations in line with vendor instructions, or to discontinue use of the product if mitigations are unavailable.
CISA says the directive applies only to Federal Civilian Executive Branch agencies. It separately encourages other organizations to use risk-based vulnerability management and prioritize KEV-listed flaws. Microsoft has released updates for the affected Office products, and its entry lists no workaround or separate mitigation.
Microsoft’s severity rating and CISA’s exploitation listing describe different aspects of the issue: Microsoft rates its technical severity as moderate, while CISA’s catalog indicates that exploitation has been observed. Neither label, on its own, identifies the attackers or the scale of any campaign.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft Security Update Guide
What Is Not Yet Known About Exploitation
The available information does not identify who is behind the attacks, which users or organizations were targeted, how many may have been affected, or when exploitation began. CISA lists ransomware use as unknown. The source material also does not provide incident totals or evidence that a specific organization has been compromised.
Although Microsoft describes the possible exposure and CISA records active exploitation, neither fact confirms that every affected Office installation has been attacked. Organizations would need to assess their own systems and available security evidence. The supplied information does not specify whether Microsoft or CISA has announced further investigation findings.
Checks to Complete Before November 24
Organizations should identify whether they run an affected Outlook product, check the installed Office build, and apply the corresponding Microsoft update. IT teams should verify that updates reached the devices they manage rather than relying only on an update policy or deployment status. Microsoft lists no workaround, so the update is the stated fix.
Federal civilian agencies must meet CISA’s November 24, 2026, deadline under the directive. Other organizations are encouraged to prioritize the flaw, though that date does not bind them under the cited directive. Administrators should consult Microsoft’s security guidance for the exact build applicable to each Microsoft 365 Apps channel, particularly where devices use update channels or servicing arrangements not covered by the builds listed here.
Key Questions
What does Outlook vulnerability CVE-2026-124194 do?
Microsoft says a crafted file opened in an affected Outlook version can cause a connection to an attacker-controlled network location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its described attack requires a user to open the crafted file.
Who has to meet the November 24 deadline?
CISA’s November 24, 2026, remediation deadline applies to U.S. Federal Civilian Executive Branch agencies. CISA urges other organizations to prioritize the flaw but does not make them subject to that directive.
Which update fixes the Outlook vulnerability?
Microsoft lists Office updates as the fix and no workaround. The supplied guidance names Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140, along with November 10 updates for Microsoft 365 Apps channels. Check Microsoft’s release guidance for the build that applies to your channel.
Is it known who was targeted or whether ransomware was involved?
No. The source material does not identify the attackers, targets, number of affected users, or start date. CISA lists use in ransomware campaigns as unknown.
Source: ThorstenMeyerAI.com
