CVE-2026-124194 – NTLMv2 Hash Leak

Overview

Microsoft’s November 10, 2026 Patch Tuesday release included a fix for CVE-2026-124194, an Outlook spoofing vulnerability that is already being exploited in the wild.

The flaw occurs because Outlook’s user interface does not properly warn the user about certain unsafe actions. An attacker can send a specially crafted message file (typically a .msg file). When a user opens that file in a vulnerable version of Outlook, the application can connect to an attacker-controlled network location without displaying the normal external-content warning.

That connection can disclose the user’s NTLMv2 hash. An attacker who captures the hash can attempt to impersonate the user (through offline cracking or relay attacks).

Microsoft confirmed exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal remediation deadline of November 24, 2026.

How The Attack Works

1. An unauthenticated attacker creates a malicious message file.
2. The attacker convinces the victim to open the file in classic Outlook.
3. Outlook connects to the attacker’s server without the usual warning dialog.
4. The victim’s NTLMv2 authentication hash is sent to the attacker.

Important Notes:

• The Preview Pane is not an attack vector. The user must open the file.
• Network connectivity is required for the hash to be leaked.
• User interaction (opening the file) is required.

Affected Products

• Microsoft 365 Apps for Enterprise (versions prior to the applicable Office Security Releases)
• Microsoft Office LTSC 2021 (builds before 16.0.14334.21048)
• Microsoft Office LTSC 2024 (builds before 16.0.17932.21140)

Both 32-bit and 64-bit versions are affected. Older perpetual Office versions and Mac editions are not listed in this advisory.

Risk

Even though Microsoft rates the issue Moderate (CVSS 6.5), the confirmed active exploitation and the ability to leak authentication material make it higher priority than many unexploited higher-scored bugs. A captured NTLMv2 hash can be used to authenticate as the victim on systems that still accept NTLM, potentially leading to further access inside a network.

What You Should Do

1. Install the November 2026 Office / Microsoft 365 security updates as soon as possible through your normal Office update channel (or Windows Update / WSUS / Intune, depending on your deployment).
2. Verify the installed build after updating:
   • Office LTSC 2021 should be at or above 16.0.14334.21048
   • Office LTSC 2024 should be at or above 16.0.17932.21140
   • Microsoft 365 Apps should be on a current Office Security Release channel build.
3. Continue to treat unexpected email attachments with caution. This vulnerability requires the user to open a malicious file.
4. Where possible, reduce reliance on NTLM authentication (prefer Kerberos, enforce SMB signing, enable Extended Protection for Authentication, etc.).

DNS Texas Managed/Hosted Customers

If your systems are covered under our managed update services, the November Office updates are being deployed through our normal process. If you manage your own patching or need assistance verifying the fix, [open a support ticket] and we’ll help.

References

• Microsoft Security Update Guide – CVE-2026-124194
• NVD – CVE-2026-124194
• CISA Known Exploited Vulnerabilities Catalog (added November 10, 2026)

This is a practical, high-priority item for any organization still running classic Outlook on Windows. Patching closes the immediate risk.