CVE-2026-124194: Outlook file leaks NTLMv2 hash

Opening one crafted message file in Outlook can hand an attacker the user's NTLMv2 hash, and attackers were using it before Microsoft shipped a fix. CVE-2026-124194 makes Outlook connect to an attacker-controlled server without its usual external-content warning, and the hash leaks with that connection. The 10 November 2026 updates fix it: Current Channel build 20527.20196, Office LTSC 2024 build 17932.21140 and Office LTSC 2021 build 14334.21048.

Microsoft's advisory for CVE-2026-124194 marks it as exploited and not publicly disclosed, the only exploited flaw in November's release. CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a due date of 24 November 2026. It hits Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. If your company runs desktop Outlook from either, it is in scope.

Check your Outlook build for CVE-2026-124194

On one machine, Microsoft's guide to update channels shows where to look: open an Office app such as Word, go to File > Account, and read the version and build under About. Across a fleet, Click-to-Run installs record the same value in the registry, as Office 365 for IT Pros documents:

Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport"

It returns a value such as 16.0.20527.20196. Compare the last two numbers with the build for your channel.

Microsoft's security release notes for 10 November 2026 list CVE-2026-124194 under Outlook, with these builds. A machine on a listed version needs that build or later.

A machine on an older version than any in the table hasn't received November's updates at all. Update it first, then check again.

How opening one Outlook file leaks an NTLMv2 hash

The attack starts with a file. Microsoft's FAQ says an unauthenticated attacker "could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook." Opening it makes Outlook connect to a network location the attacker controls, and it does so "without displaying the usual external-content warning."

That missing warning is the bug. NVD's record files it under CWE-356, a product interface that doesn't warn users about unsafe actions. The warning is what normally gives a user the chance to refuse the connection.

The connection is where the damage happens. Microsoft's FAQ is direct about it: "This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user." That last step is the spoofing in the bug's name: with the hash, an attacker can pass as the user.

“It's labeled spoofing, but the impact is bigger than the name suggests.”

— Dustin Childs, Zero Day Initiative's November 2026 review

An attacker can use a captured hash in two ways. Rapid7's analysis notes that the hash can be relayed live to another service that accepts NTLM, or cracked offline to recover the password. How fast cracking works depends on how strong the password is.

Two details narrow the attack. The Preview Pane is not an attack vector, Microsoft says, so the user has to open the file; previewing the message isn't enough. None of the advisories or analyses names the protocol Outlook uses for the connection, so we don't guess one here.

Stealing NTLM hashes through a phishing attachment isn't new. We covered the same goal in TA577's phishing campaign that targeted NTLM hashes, where blocking outbound SMB and restricting NTLM were the defences.

Who is exploiting CVE-2026-124194?

Nobody has said. Microsoft's advisory sets "Exploited: Yes" and "Publicly Disclosed: No", and CISA's catalog lists ransomware use as unknown. None of the Patch Tuesday analyses names an attacker, a campaign or a target.

The credit line is unusual. Microsoft acknowledges two reporters: one listed as "Benoît Sevens using Claude with Anthropic", and one listed as "nono". I read an exploited zero-day credited partly to work with an AI model as a sign of where vulnerability research is heading, a trend we followed in OpenAI's report of 948 working Linux proofs of concept in 30 hours.

The CVSS score undersells the urgency. Microsoft scores CVE-2026-124194 6.5 and rates it Moderate; the attack needs a user to open a file. Exploitation is already happening, though, so I'd patch it ahead of most of the month's Critical fixes.

Block NTLM leaks while the update rolls out

Updating Outlook closes this hole. Neither Microsoft nor the Patch Tuesday analyses list a workaround for this CVE, and Microsoft's advisory marks customer action as required. While the update reaches every machine, two controls limit what a leaked hash can do.

First, stop Windows from sending NTLM to servers you don't know. The Group Policy setting is documented in Microsoft's page on restricting outgoing NTLM traffic:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
  Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers

Microsoft's own advice is to start with Audit all and read the log before you block anything.

1. Set the policy to Audit all. Each NTLM request to a remote server is then logged under Applications and Services Log\Microsoft\Windows\NTLM.

2. Review that log, and list the servers that legitimately need NTLM in the companion policy, "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication".

3. Switch the policy to Deny all. Machines then can't authenticate with NTLM to any remote server outside the exception list.

The audit log doubles as detection. I'd investigate any outgoing NTLM to a server outside your network, especially from a machine that has just opened an attachment.

Second, make relayed hashes useless where you can. Rapid7 lists SMB signing, LDAP signing and Extended Protection for Authentication on Exchange and AD CS as the defences against NTLM relay.

What the Outlook update doesn't fix

The update stops new leaks. It does nothing about a hash that has already left the network. If a user opened an unexpected message file before their machine was patched, I'd treat that account's password as exposed and reset it.

The advisory's product list is also narrow. Microsoft names Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit editions. It says nothing either way about older Office versions, so their absence from the list isn't proof they're safe.

Finally, the external-content warning is only as good as the user reading it. Even with the bug fixed, the NTLM restriction above is the control that doesn't rely on someone clicking the right button.

What to do this week

1. Run the version check across your fleet and list every machine below the build for its channel.

2. Push November's Office update to those machines first, starting with people who handle outside email.

3. Turn on Audit all for outgoing NTLM today; the audit mode blocks nothing.

4. Reset the passwords of anyone who opened a suspicious message file before patching.

CISA's due date is 24 November 2026. For everyone else, the useful deadline is the next phishing email that reaches an unpatched Outlook.