CVE-2026-124194: Outlook Zero-Day Exposes NTLM Hashes - SOC Prime

Microsoft has addressed CVE-2026-124194, a zero-day vulnerability in Outlook that has already been exploited in attacks. The flaw allows attackers to steal NTLMv2 authentication hashes when victims open specially crafted message files. Microsoft classifies the issue as a spoofing vulnerability with a CVSS 3.1 score of 6.5, rating it Moderate.

The vulnerability enables unauthenticated attackers to send malicious messages that, when opened, cause Outlook to connect to attacker-controlled network locations without displaying the usual external-content warnings. During these connections, Windows may expose NTLMv2 authentication information that could be used to impersonate victims.

Active Exploitation Details

Microsoft has confirmed that CVE-2026-124194 has been actively exploited but has not disclosed details about the threat actors, campaign scale, or victim organizations. The company also hasn't revealed whether stolen authentication material has been used for lateral movement or account compromise.

The flaw was fixed in Microsoft's November 2026 Patch Tuesday release on November 10. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both 32-bit and x64 systems.

Detection Methods

Security teams should monitor for Outlook activity correlating with unexpected outbound SMB connections, NTLM authentication attempts to external systems, suspicious message-file execution, and subsequent credential abuse. Outbound TCP port 445 traffic deserves particular attention.

Microsoft recommends blocking outbound SMB traffic to the internet as a defense-in-depth measure. Organizations should also review Microsoft's NTLM Operational log and audit outgoing NTLM authentication to remote servers.

Remediation Steps

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, establishing November 24, 2026 as the remediation deadline for U.S. federal agencies. Organizations should immediately install Microsoft's November 2026 Office security updates.

Office LTSC 2021 installations should be updated to build 16.0.14334.21048 or later, while Office LTSC 2024 installations should run 16.0.17932.21140 or later. Microsoft 365 Apps for Enterprise users should verify their servicing channel has received the current security release.

Additional measures include inventorying Outlook installations, verifying update deployment, blocking unnecessary outbound SMB traffic, auditing outgoing NTLM authentication, educating users about suspicious messages, and investigating unusual Outlook-to-network activity.