---
title: Patch Tuesday zero-day: an Outlook flaw that leaks NTLMv2 hashes when a user opens a crafted message file is already being exploited (CVE-2026-124194) | ctxsec
url: https://ctxsec.com/items/outlook-zero-day-cve-2026-124194-ntlm-hash-leak-exploited-kev-nov-10
description: "Microsoft says CVE-2026-124194 is exploited in the wild. An attacker sends a crafted message file; when the user opens it in Outlook, Outlook connects to an attacker-controlled network location without the usual external-content warning and hands over the user's NTLMv2 hash, which can be relayed or cracked to log in as that user. Microsoft rates it Moderate (CVSS 3.1 6.5) because nothing executes, but CISA added it to KEV the same day with a Nov 24 deadline. The Preview Pane is not an attack vector; the user has to open the file. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024."
status: "official (MSRC, Nov 10, 2026: Exploited: Yes; CISA KEV added Nov 10, federal due date Nov 24)"
published: 2026-11-10
---

> Microsoft says CVE-2026-124194 is exploited in the wild. An attacker sends a crafted message file; when the user opens it in Outlook, Outlook connects to an attacker-controlled network location without the usual external-content warning and hands over the user's NTLMv2 hash, which can be relayed or cracked to log in as that user. Microsoft rates it Moderate (CVSS 3.1 6.5) because nothing executes, but CISA added it to KEV the same day with a Nov 24 deadline. The Preview Pane is not an attack vector; the user has to open the file. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.

[← Cybersecurity News](/news) · [markdown](/items/outlook-zero-day-cve-2026-124194-ntlm-hash-leak-exploited-kev-nov-10.md)

official (MSRC, Nov 10, 2026: Exploited: Yes; CISA KEV added Nov 10, federal due date Nov 24)

2026-11-10

### Patch Tuesday zero-day: an Outlook flaw that leaks NTLMv2 hashes when a user opens a crafted message file is already being exploited (CVE-2026-124194)

- **Fixed builds:** Office LTSC 2024 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048; Microsoft 365 Apps on Current Channel 2610 build 20527.20196 and the matching Monthly/Semi-Annual Enterprise builds listed in Microsoft's Office release notes.
- **Not a Windows update:** a fully patched Windows dashboard says nothing about Office click-to-run builds; check the Outlook build on endpoints.
- **Credit:** MSRC acknowledges "Benoît Sevens using Claude with Anthropic" and "nono". Microsoft hasn't said who is exploiting it or how widely.
- **Severity label vs. reality:** it's the only exploited Microsoft bug this month and outranks the higher-scored Criticals. See the hunt and tip items for detection and NTLM hardening.

Sources: [MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194) · [CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog) · [Microsoft Learn: Release notes for Microsoft Office security updates (Nov 10, 2026)](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates) · [Tenable: Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (Nov 10, 2026)](https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194)