CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability - CyberSecurityNews
The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability that can expose user authentication data.
According to Microsoft's security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook. The application may then connect to an attacker-controlled network location without showing its usual warning about external content.
That connection can disclose the victim's NTLMv2 hash, authentication data that an attacker could use to impersonate the user. Microsoft classifies the issue as spoofing rather than remote code execution, with a high impact on confidentiality but no direct impact on data integrity or service availability.
Vulnerability Details
The weakness falls under CWE-356, which covers software that fails to obtain proper user approval before a potentially unsafe action. Microsoft lists affected 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
Missing user interaction does not mean this is a zero-click attack. Microsoft explicitly states that the victim must open a malicious file.
Remediation Required
CISA added the flaw to its KEV catalog on November 10, 2026, setting a November 24 remediation deadline. Organizations must apply vendor mitigations, assess internet exposure, and discontinue affected products if fixes are unavailable.
Administrators should identify affected Office installations, deploy the relevant fixes, and verify installed build numbers rather than relying only on update deployment reports. The moderate severity label should not outweigh the confirmed exploitation evidence when teams set their patching order.
Related
