🔍 Read the full analysis: November 24 Deadline For Outlook Zero-Day: What To Patch Now on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash after the user opens a crafted file. CISA added it to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 deadline for U.S. federal civilian agencies. Microsoft lists Office updates as the fix and no workaround.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook spoofing vulnerability that can expose a user’s NTLMv2 hash when the user opens a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, giving U.S. federal civilian agencies until Nov. 24, 2026, to apply the available Office updates.
Microsoft describes an attack in which an unauthenticated attacker sends a malicious Office file and persuades a user to open it in an affected version of Outlook. Outlook can then connect to an attacker-controlled network location without the usual external-content warning. Microsoft says that connection may disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as the user. The flaw does not itself provide code execution, and the user must open the file; Microsoft says the Preview Pane is not an attack vector.
Microsoft rates the vulnerability Moderate, with a CVSS score of 6.5. It lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions, as affected. Microsoft lists no workaround or separate mitigation: installing the applicable security update is the fix. The fixed builds specified in the source are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps updates vary by servicing channel and version, so administrators should verify the corresponding November security-release build for their channel.
CISA’s Nov. 10 catalog notice says the vulnerabilities added that day were included “based on evidence of active exploitation.” The directive deadline applies to federal civilian executive branch agencies, not every organization. CISA encourages other organizations to prioritize vulnerabilities in the KEV catalog using risk-based vulnerability management. Its entry directs agencies to follow vendor instructions and to discontinue use of a product if mitigations are unavailable; Microsoft has published updates for this Outlook flaw.
Patch Outlook’s exploited flaw before November 24
Microsoft says attackers can expose a user’s NTLMv2 hash when the user opens a crafted file in affected Outlook. Install the applicable Office security update.
How the attack works
A user must open the malicious file; Microsoft says the Preview Pane is not an attack vector.
An unauthenticated attacker sends a malicious Office file.
Outlook may connect to an attacker-controlled network location without the usual warning.
The NTLMv2 hash could be used to authenticate as the affected user.
Who must meet the deadline?
CISA’s binding deadline applies to federal civilian executive branch agencies.
- Apply the vendor update by November 24, 2026.
- Follow CISA’s directive and verify affected installations.
- The cited notice does not impose this federal deadline.
- CISA encourages risk-based prioritization of KEV vulnerabilities.
What to patch
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected.
| Office edition | Fixed build or action |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check the November security build for your servicing channel |
Why Stolen Outlook Credentials Matter
The risk is not limited to an Outlook warning being missed. An exposed NTLMv2 hash can provide a route to authenticate as the affected user, according to Microsoft. In an organization, access to one account can create additional security concerns, depending on that account’s permissions and the network’s protections. The source does not establish that every successful attack leads to further access, but credential exposure makes prompt patching relevant beyond the individual mailbox.
The flaw’s rating and its active-exploitation status describe different aspects of the issue. Microsoft rates its severity as moderate, and exploitation requires a user to open a malicious file. At the same time, Microsoft marks exploitation as detected and CISA has placed it on a catalog intended to identify vulnerabilities exploited in the wild. For administrators, the practical priority is to confirm the installed build, rather than rely on whether updates are generally enabled or expected to install automatically.
The Nov. 24 date is a binding deadline for the federal agencies covered by CISA’s directive. For businesses, schools and other organizations outside that scope, it is not a legal deadline based on the cited notice, but the active-exploitation designation supports treating the update as a priority.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
As an affiliate, we earn on qualifying purchases.
How the Nov. 24 Deadline Applies
CISA added CVE-2026-124194 to its KEV catalog on Nov. 10, 2026, alongside five other vulnerabilities in products from Cisco, Barracuda Networks, Openwave and Google Chromium. The catalog entry sets a due date of Nov. 24 and directs covered agencies to apply vendor mitigations. CISA’s notice says its binding directive applies only to federal civilian executive branch agencies.
The vulnerability is categorized as a missing user interaction warning: Outlook may connect to an unsafe external location without showing the warning a user would ordinarily expect. Microsoft says an attacker needs to send the file and convince the recipient to open it. The source material reports that CISA’s record marks exploitation as active, automation as “no,” and technical impact as “partial.” Those classifications do not establish the scale or targets of attacks; the source author interprets them as consistent with attacks requiring a human to open a file.
For Microsoft 365 Apps, the available build depends on the update channel. The source lists November 10 builds including Current Channel version 2610, build 20527.20196, and several Monthly Enterprise and Semi-Annual Enterprise Channel builds. Because the supplied source excerpt cuts off partway through the channel list, administrators should consult Microsoft’s Security Update Guide and release information for the complete, current build applicable to their deployment.
““An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.””
— Microsoft, in its CVE-2026-124194 security entry
What Is Known About the Attacks
The available source material does not identify who is behind the attacks, which organizations or individuals were targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists ransomware use as “Unknown,” which means the cited record does not establish whether the flaw has been used in ransomware campaigns. The source also says the entry is not marked for forensic triage under the directive; that catalog field should not be read as proof that no compromise has occurred.
The source does not provide a complete Microsoft 365 Apps build list: its channel details end partway through the Semi-Annual Enterprise Channel entry. Exact fixed builds for other versions or channels should be checked against Microsoft’s current update documentation. The source also does not establish whether attackers can obtain usable credentials in every case; Microsoft’s wording says the hash could be used to authenticate as the user.
Verify Office Builds Before Nov. 24
Federal civilian agencies must meet CISA’s Nov. 24, 2026, deadline by applying the vendor update in line with the directive. IT teams should inventory affected Office installations and confirm that each has reached the applicable fixed build. Microsoft 365 Apps administrators need to check the build for their specific servicing channel, while Office LTSC administrators can compare installations with Microsoft’s listed fixed versions.
Organizations outside the directive can use the same checks to prioritize remediation, although the cited CISA notice does not impose its federal deadline on them. Microsoft and CISA may publish further information about the flaw or updates; based on the supplied material, no additional attack details or separate workaround have been announced. Until more is known, the immediate confirmed action is to install the applicable Office update and verify that it has taken effect.
Key Questions
What is the Outlook vulnerability?
CVE-2026-124194 is an Outlook spoofing vulnerability. Microsoft says opening a specially crafted file can cause Outlook to connect to an attacker-controlled location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Does opening the Preview Pane trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says the attack requires the recipient to open the specially crafted file.
Who must meet the Nov. 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the CISA directive described in the source. CISA encourages other organizations to prioritize KEV vulnerabilities, but the cited notice does not make this deadline binding on them.
What should administrators patch?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed builds. Microsoft 365 Apps builds depend on the servicing channel; check Microsoft’s security update information for the version deployed. The source says Microsoft lists no workaround.
Do officials know who was targeted?
The supplied reporting does not identify the attackers, targets, number of victims, or start date of exploitation. CISA’s entry also lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
