🔍 Read the full analysis: Outlook Zero-Day Under Attack: Your November 24 Action Plan on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash after the user opens a malicious file. CISA added it to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 remediation deadline for U.S. federal civilian agencies; Microsoft lists Office updates as the fix.
Microsoft says attackers are exploiting CVE-2026-124194, a vulnerability in Outlook that can expose a user’s NTLMv2 hash when the user opens a specially crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 remediation deadline for U.S. federal civilian agencies; Microsoft lists Office security updates as the fix.
Microsoft describes the issue as the Microsoft Outlook Spoofing Vulnerability and rates it moderate, with a CVSS score of 6.5 out of 10. Its account says an unauthenticated attacker can send a malicious Office file and try to persuade a user to open it. Outlook may then connect to an attacker-controlled network location without showing the usual external-content warning.
That connection can disclose the user’s NTLMv2 hash, a credential-related authentication value. Microsoft says an attacker could use the hash to authenticate as the user. The attack requires the recipient to open the file, but Microsoft’s entry says the Preview Pane is not an attack vector. The flaw does not itself provide code execution.
Microsoft lists no workaround or separate mitigation: installing the security update is the fix. The source material gives fixed builds for Office LTSC 2021, 16.0.14334.21048, and Office LTSC 2024, 16.0.17932.21140. For Microsoft 365 Apps, it lists November 10 security builds for several channels, including Current Channel Version 2610, Build 20527.20196. Administrators should check Microsoft’s Security Update Guide for the applicable channel and build before confirming deployment.
Outlook Zero-Day Under Attack Your November 24 Action Plan
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash when a malicious file is opened. Microsoft lists Office security updates as the fix.
How the attack works
The attack requires a user to open a specially crafted file; Preview Pane alone is not an attack path.
An attacker tries to persuade a recipient to open a crafted Office file.
It may connect to an attacker-controlled location without the usual warning.
The connection can disclose the user’s NTLMv2 hash, which Microsoft says could be used to authenticate as that user.
Who must meet the deadline?
CISA’s binding date applies to U.S. federal civilian executive branch agencies.
- Apply the vendor fix by Nov. 24.
- Follow CISA’s directive.
- The federal deadline is not stated as mandatory for them.
- CISA encourages prioritizing KEV-listed flaws using risk-based management.
What to update
Confirm the applicable product and channel build in Microsoft’s Security Update Guide before verifying deployment.
| Office product | Fixed build listed |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps, Current Channel | Version 2610, Build 20527.20196 |
What remains unclear
Microsoft and CISA confirm exploitation, but the available information does not establish incident details.
- Attacker identity, targets, victim count, and when exploitation began are unknown.
- Ransomware use is listed as unknown; that does not confirm or rule it out.
- The catalog’s forensic triage status does not prove whether systems were accessed.
Credential Exposure Makes Patching Urgent
The vulnerability does not need to run code to create risk: disclosure of an authentication value can give attackers a route to impersonate a user, according to Microsoft. In an organization, compromised credentials may be useful for further access, although the source material does not establish that attackers have used this flaw for any particular follow-on activity.
The immediate operational issue is the combination of confirmed exploitation and no listed workaround. Federal civilian agencies are subject to a firm date, while other organizations are not bound by that directive. CISA nonetheless urges all organizations to prioritize vulnerabilities in its KEV catalog, making the Nov. 24 date a practical reference point for security teams outside government as well.
The flaw’s moderate severity rating should not be mistaken for evidence that it can be ignored. The rating describes the vulnerability under a scoring system; CISA’s catalog addition reflects evidence of exploitation. Organizations should base their response on both the technical details and their exposure, including whether affected Outlook versions remain in use and whether the update has reached them.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
Bose TV Speaker (2nd Gen) Compact Soundbar
As an affiliate, we earn on qualifying purchases.
How CISA Set the November Deadline
CISA added six vulnerabilities to its KEV catalog on Nov. 10, 2026, saying the additions were based on evidence of active exploitation. The Outlook issue appeared alongside flaws involving products from Cisco, Barracuda Networks, Openwave and Google Chromium. CISA’s catalog entry sets a due date of Nov. 24 and directs agencies to apply vendor mitigations or discontinue use if mitigations are unavailable.
The deadline comes under CISA’s binding directive for U.S. federal civilian executive branch agencies, not every public or private organization. CISA encourages other organizations to use risk-based vulnerability management and prioritize KEV-listed flaws, but the source material does not say the federal deadline applies to them.
Microsoft classifies the issue as a failure to warn users about a potentially unsafe action. Its description says a user must open the malicious file; the Preview Pane alone is not an attack path. CISA’s record marks ransomware use as unknown and does not flag the flaw for forensic triage under the directive. Those catalog fields do not establish whether any particular organization has been compromised.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 entry
Attackers and Victims Remain Unknown
The available source material does not identify who is behind the attacks, which organizations or individuals were targeted, how many may have been affected, or when exploitation began. CISA’s entry says use in ransomware campaigns is unknown; that does not confirm or rule out ransomware activity.
The catalog also does not mark the vulnerability for forensic triage. That status is part of CISA’s directive process and should not be read as proof that no systems were accessed. The source material provides no case-level evidence about compromises or the scale of the activity. Microsoft and CISA have confirmed exploitation, but further details about incidents remain unclear.
Verify Office Builds Before November 24
U.S. federal civilian agencies must meet CISA’s Nov. 24, 2026 deadline by applying the vendor fix, in line with the directive. IT teams should inventory affected Office deployments, confirm the installed build against Microsoft’s update guidance for each product and Microsoft 365 Apps channel, and follow up on devices that have not received the update. The source material lists no alternative workaround.
Organizations outside the federal executive branch should assess whether they use affected Outlook products and prioritize patching according to their exposure and risk. Microsoft and CISA may provide further technical or incident information, but no additional milestone or public attribution is specified in the available material.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a specially crafted file, when opened in affected Outlook versions, can cause Outlook to connect to an attacker-controlled location without the usual warning. That may disclose the user’s NTLMv2 hash.
Does the Preview Pane trigger the attack?
No. Microsoft’s entry says the Preview Pane is not an attack vector. The described attack requires a user to open the malicious file.
Who has to meet the November 24 deadline?
The date is binding for U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize KEV vulnerabilities, but the source does not make the deadline mandatory for them.
What should organizations install?
Microsoft lists Office security updates as the fix and gives fixed builds for Office LTSC 2021 and 2024, along with November 10 builds for Microsoft 365 Apps channels. Administrators should check Microsoft’s Security Update Guide for the build that applies to their product and channel.
Is there a workaround, and who is being targeted?
The source material says Microsoft lists no workaround. It also says the attacker identity, targets, victim count and start date of exploitation are not known.
Source: ThorstenMeyerAI.com
