Exploited Outlook zero-day was found by a researcher using Claude - Notebookcheck
Microsoft fixed 1,093 vulnerabilities in its November Patch Tuesday, including an Outlook zero-day that attackers are already exploiting to steal NTLMv2 hashes.
Microsoft released its monthly security updates on November 10, 2026, addressing 1,093 vulnerabilities across Windows, Office and other products. Among these is a critical Outlook vulnerability (CVE-2026-124194) that attackers are already actively exploiting to steal NTLMv2 hashes from users.
The flaw is classified as a spoofing vulnerability with a CVSS score of 6.5. An attacker only needs to send a specially crafted message file and convince the victim to open it in Outlook. Once opened, Outlook connects to an attacker-controlled server without displaying the usual warning about external content, potentially exposing the user's credentials.
AI-Assisted Discovery
Microsoft credits the discovery of this vulnerability to a researcher using Anthropic's Claude AI. The acknowledgment specifically mentions nono and Benoît Sevens, who found the flaw using Claude with Anthropic. This represents another example of AI tools being used to identify security vulnerabilities in software.
discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user.
Affected Products and Fixes
The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Notably, Office 2016 and Office 2019 are not listed as affected, though these versions haven't received security updates since October 2025.
To install the updates, Windows 11 users should go to Settings > Windows Update (KB5132061). Office typically updates automatically, but users can manually trigger updates through File > Office Account > Update Options. For Office LTSC 2024, build 16.0.17932.21140 contains the fix, while for Office LTSC 2021, it's build 16.0.14334.21048.
Until the update is installed, users should avoid opening message files or Office documents from unexpected emails, even if the sender appears familiar. Security experts recommend backing up important data before applying operating system updates.
Related
