Microsoft warns Outlook users to update after zero-day flaw exploited - 디지털투데이
Microsoft has fixed an Outlook security vulnerability that was exploited in actual cyberattacks and urged users to update quickly.
The flaw, CVE-2026-124194, can connect to an external server without warning when a malicious file is opened, potentially leaking Windows authentication credentials. Microsoft confirmed the vulnerability had already been used in actual attacks before the security patch was disclosed.
Attack mechanism
Outlook does not warn users about risky external connections. An attacker can send a specially crafted message file and prompt a recipient to open it. When opened, Outlook connects to a network location controlled by the attacker and skips the external content access warning normally shown.
This process carries the risk of exposing an NTLMv2 hash used for Windows authentication. An attacker can use the captured hash to impersonate a user or attempt follow-on attacks to gain unauthorized access to other systems.
Response timeline
Microsoft classified the vulnerability as spoofing with a CVSS score of 6.5 and severity rating of medium. The November monthly update fixed more than 1,000 security vulnerabilities, with 63 classified as critical. The U.S. Cybersecurity and Infrastructure Security Agency added the Outlook flaw to its catalog of known exploited vulnerabilities, setting a deadline for federal agencies by the 24th.
Affected products
Affected products include Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024. Users need to check separately from Windows Update whether an Office security update has been applied. No specific exploitation cases, such as the attacker and the scale of damage, have been disclosed so far.
Related
