Microsoft has released security updates addressing an actively exploited zero-day vulnerability in Microsoft Outlook that could allow attackers to steal NTLM authentication credentials and potentially impersonate affected users.
Tracked as CVE-2026-124194, the vulnerability allows an unauthenticated attacker to craft a malicious Outlook message file that triggers an outbound connection to an attacker-controlled server when opened by a victim. The connection can expose NTLMv2 authentication material without Outlook displaying its usual external-content security warning.
Microsoft patched the vulnerability on November 10, 2026, as part of its monthly Patch Tuesday updates and confirmed that exploitation had already been detected in the wild.
CVE-2026-124194 Vulnerability Overview
CVE-2026-124194 is a spoofing vulnerability affecting Microsoft Office Outlook for Windows.
The vulnerability is classified as CWE-356: Product UI Does Not Warn User of Unsafe Actions, meaning the application fails to provide an expected security warning before performing a potentially dangerous operation.
In this case, Outlook can establish a connection to an external network resource referenced by a specially crafted message file without notifying the user.
Windows may then automatically attempt NTLM authentication to that resource, potentially exposing authentication material to an attacker controlling the destination.
The vulnerability has the following characteristics:
| Attribute | Details |
| CVE ID | CVE-2026-124194 |
| Affected software | Microsoft Office Outlook |
| Vulnerability type | Spoofing / Forced Authentication |
| CWE | CWE-356 |
| CVSS v3.1 | 6.5 (Medium) |
| Attack vector | Network |
| Privileges required | None |
| User interaction | Required |
| Active exploitation | Confirmed by Microsoft |
| CISA KEV | Added November 10, 2026 |
| Security update | November 10, 2026 |
The vulnerability primarily affects confidentiality rather than system integrity or availability. However, the potential exposure of enterprise authentication material creates opportunities for attackers to compromise additional systems.
How CVE-2026-124194 Works
The vulnerability exploits Outlook’s handling of external network resources embedded in specially crafted message files.
When an affected Outlook installation processes the malicious file after user interaction, it may initiate a network connection without displaying the expected external-content warning.
A potential exploitation sequence involves the following steps:
- Malicious file preparation: An attacker prepares a specially crafted Outlook message file containing a reference to an attacker-controlled network location.
- Delivery: The attacker distributes the file to a targeted user. A phishing email attachment or malicious shared file is a plausible delivery method, although Microsoft has not publicly confirmed the delivery mechanisms used in observed attacks.
- User interaction: The victim opens the malicious message file using a vulnerable version of Outlook.
- Forced authentication: Outlook attempts to access the external network resource without displaying its normal security warning. Depending on the protocol and Windows authentication configuration, this can cause the operating system to initiate NTLM authentication.
- Credential exposure: The attacker-controlled destination receives NTLM authentication material associated with the victim’s account.
The exposed material can include an NTLMv2 challenge-response value, commonly described in vulnerability advisories as an NTLMv2 hash.
This is not the same as obtaining the user’s plaintext password or the underlying NT password hash. Nevertheless, the captured authentication exchange may be useful for an NTLM relay attack or offline password recovery.
Importantly, the Outlook Preview Pane is not an attack vector for CVE-2026-124194. The attacker must convince the user to open the specially crafted message file.
This distinction separates the vulnerability from certain previously exploited Outlook credential-theft flaws that required no user interaction.
Why the NTLM Credential Exposure Matters
NTLM is a Windows authentication protocol still used by numerous enterprise applications, file servers, and legacy infrastructure components.
When a Windows system attempts to authenticate to an external resource, it may transmit challenge-response authentication information derived from the user’s credentials.
If an attacker successfully captures this information, several follow-on attacks may become possible:
- NTLM relay: Forwarding an authentication exchange to another service that accepts NTLM, provided the necessary protocol and security conditions permit relay.
- Offline password cracking: Attempting to recover the user’s password from captured challenge-response material, particularly where weak or reused passwords are involved.
- Unauthorized authentication: Accessing network resources after successfully relaying authentication or recovering usable credentials.
- Lateral movement: Attempting to extend access to additional systems using privileges obtained through a successful follow-on compromise.
These outcomes are conditional. Capturing an NTLMv2 challenge-response does not automatically grant unrestricted access to the victim’s account or Microsoft 365 tenant.
The severity of a successful attack depends on factors including NTLM usage, password strength, authentication protections, network segmentation, and the permissions associated with the targeted account.
Active Exploitation and Threat Intelligence
Microsoft confirmed that CVE-2026-124194 had been exploited before the November 10 security update became available.
CISA subsequently added the vulnerability to its KEV Catalog, confirming that the issue represents an active threat rather than a purely theoretical vulnerability.
Affected Microsoft Outlook Versions
According to Microsoft’s vulnerability records, CVE-2026-124194 affects Outlook included with the following products:
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2024
- Microsoft Office LTSC 2021
Both 32-bit and 64-bit editions of the listed products are affected.
Microsoft published the relevant security updates on November 10, 2026.
| Microsoft Office product | November 10 security update |
| Microsoft 365 Apps – Current Channel | Version 2610, Build 20527.20196 |
| Microsoft 365 Apps – Monthly Enterprise Channel | Version 2610, Build 20527.20194 |
| Microsoft 365 Apps – Semi-Annual Enterprise Channel | Version 2610, Build 20527.20192 |
| Office LTSC 2024 – Volume Licensed | Build 17932.21140 |
| Office LTSC 2021 – Volume Licensed | Build 14334.21048 |
Microsoft also released updates for additional supported Monthly Enterprise and Semi-Annual Enterprise version branches. Administrators should consult the official Microsoft Office security update release notes to identify the correct patched build for each deployment.
Mitigation and Recommendations
Organizations should prioritize applying Microsoft’s security updates while strengthening controls that prevent or limit NTLM credential exposure.
1. Apply the November 2026 Microsoft Office Security Updates
Deploy the updates released on November 10, 2026, to all affected Outlook installations.
Prioritize endpoints used by privileged personnel and systems where older Office versions or delayed update channels remain in use.
Verify successful deployment by checking the installed Office build against Microsoft’s official release documentation.
2. Block Unnecessary Outbound SMB Traffic
Restrict outbound SMB connections to untrusted destinations, particularly internet-facing systems.
Microsoft recommends blocking outbound TCP port 445 at corporate firewalls as a general security-hardening measure.
Apply equivalent endpoint firewall protections to roaming laptops and other devices that may operate outside the corporate perimeter.
Review legitimate business requirements, including approved cloud file-sharing services, before introducing restrictive rules.
3. Reduce Reliance on NTLM Authentication
Organizations should audit NTLM usage and progressively migrate compatible systems toward stronger authentication mechanisms, such as Kerberos.
Windows provides a Group Policy setting named Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.
Administrators can initially configure auditing to identify dependencies before considering restrictions or denial policies.
Any NTLM restriction should be tested carefully because legacy applications and infrastructure components may depend on the protocol.
4. Strengthen Protection Against NTLM Relay
Require SMB signing where supported and appropriately configure LDAP signing, channel binding, and other relevant authentication protections.
These controls can reduce opportunities for attackers to relay captured authentication material to internal services.
Organizations should also review unnecessary WebDAV functionality and disable the Windows WebClient service on endpoints where it is not required.
These measures provide defense in depth but do not replace the Outlook security update.
5. Restrict Suspicious Message Attachments
Consider temporarily blocking or quarantining externally received Outlook message files where operationally feasible.
Use email security controls to inspect suspicious attachments and warn users against opening unexpected message files.
Because exploitation requires user interaction, reducing exposure to untrusted files can help limit attack opportunities.
Stay Safe. Stay Secure.
OP Innovate Research Team
