TL;DR
Microsoft and CISA say attackers are exploiting CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a malicious file is opened. Federal civilian agencies have until November 24, 2026, to apply the available Office updates; CISA urges other organizations to prioritize remediation too.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash after the user opens a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a November 24 deadline for federal civilian agencies to remediate it.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft describes the issue as a spoofing vulnerability in Outlook. Its advisory says an attacker could send a specially crafted message file and persuade a user to open it. Outlook may then connect to a network location controlled by the attacker without showing the usual external-content warning, potentially disclosing the user’s NTLMv2 hash. Microsoft says an attacker could use that information to authenticate as the user. The flaw does not, by itself, allow code execution, and a user must open the file for the described attack to work.
Microsoft’s advisory says the Preview Pane is not an attack vector. It lists the severity as Moderate and gives the vulnerability a CVSS score of 6.5 out of 10. CISA’s November 10 alert says the six vulnerabilities added to the KEV catalog that day were included based on evidence of active exploitation. For CVE-2026-124194, the catalog lists a November 24, 2026, due date and directs agencies to apply mitigations under vendor instructions, or discontinue use if mitigations are unavailable.
Microsoft lists Office LTSC 2021 and Office LTSC 2024, in both 32-bit and 64-bit editions, and Microsoft 365 Apps for Enterprise among the affected products. The stated fixed builds are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, Microsoft lists the November 10 builds for each update channel. Its entry lists no workaround; the update is the available fix.
Why the Outlook Hash Exposure Matters
A stolen NTLMv2 hash can put an organization’s account security at risk. Microsoft says an attacker could use the disclosed hash to authenticate as the affected user. The advisory does not say that every exposed hash will lead to account access, but the potential consequence gives the flaw significance beyond an Outlook warning being missed.
The attack described by Microsoft requires a user to open a malicious file, and Microsoft says previewing it in the Preview Pane is not sufficient. That limits the described route, while leaving email users and the systems that process their files exposed to targeted lures. CISA’s catalog inclusion is a signal that exploitation has been observed; it does not, by itself, establish how widespread the activity is.
The November 24 date is a binding remediation deadline for U.S. federal civilian executive branch agencies under CISA’s directive. CISA says other organizations should also prioritize KEV vulnerabilities through risk-based vulnerability management. Those organizations are not covered by this directive’s deadline, but the active exploitation listing makes the patch relevant to their security decisions as well.
Products Worth Considering
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
As an affiliate, we earn on qualifying purchases.
How CISA Set the Patch Deadline
CISA’s Known Exploited Vulnerabilities catalog tracks security flaws for which the agency cites evidence of exploitation. On November 10, 2026, it added six vulnerabilities, including the Outlook issue, and assigned each a remediation due date. The same alert says the directive applies only to federal civilian executive branch agencies, often abbreviated FCEB.
The entry identifies the Outlook flaw as a missing user interaction for a potentially unsafe action. Microsoft’s description centers on Outlook connecting to an attacker-controlled network location without the normal warning. This article’s factual basis is the supplied account of Microsoft’s Security Update Guide and CISA’s KEV catalog and alert, dated November 10, 2026.
CISA’s deadline is a compliance requirement for the covered agencies, not a universal deadline for businesses or individuals. CISA encourages all organizations to prioritize KEV-listed vulnerabilities. Microsoft has released updates for the affected products, and its advisory does not list a workaround or separate mitigation.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 advisory
What Is Known About the Attacks
The supplied source material does not identify who is behind the exploitation, which organizations or users have been targeted, how many may be affected, or when the activity began. CISA’s catalog marks use in ransomware campaigns as unknown. Its entry also does not establish that a particular organization has been compromised.
The source describes CISA’s forensic triage field for this entry as set to no, meaning the flaw is not designated for the additional compromise checks covered by that field under the cited directive. That designation does not establish whether an individual organization has been targeted or accessed. The available material also does not provide incident counts or a measure of how broadly the flaw is being exploited.
Apply the November Office Updates
Federal civilian agencies must meet CISA’s November 24, 2026, deadline by applying the vendor updates or following the directive’s instruction to discontinue use if mitigation is unavailable. Microsoft has released fixes, so administrators should check installed Office build numbers rather than assume devices updated automatically. The relevant fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024; Microsoft 365 Apps users should check the November 10 build for their update channel.
Organizations outside the federal civilian executive branch should assess exposure and prioritize the update in line with CISA’s recommendation. Microsoft and CISA may publish further information as exploitation reports develop. The supplied source material does not identify a subsequent milestone or a separate deadline for those organizations.
Key Questions
What does CVE-2026-124194 do?
Microsoft says a specially crafted file opened in an affected Outlook version can cause Outlook to connect to an attacker-controlled network location without the usual warning. That connection may disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
Does opening the Preview Pane trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its advisory says the described attack requires a user to open the malicious file.
Who must patch by November 24?
CISA’s directive sets the November 24, 2026, deadline for U.S. federal civilian executive branch agencies. CISA encourages other organizations to prioritize KEV vulnerabilities, but the directive’s deadline applies only to those agencies.
What is the fix?
Microsoft lists Office updates as the fix and provides no workaround in its advisory. The supplied source gives fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024, plus November 10 builds for Microsoft 365 Apps update channels.
Who is exploiting the flaw, and how widespread is it?
The supplied source material does not identify the attackers, targets, start date, or number of affected users. CISA’s catalog lists ransomware use as unknown, and the available information does not quantify the scale of exploitation.
Source: Thorsten Meyer AI
