🔍 Read the full analysis: Outlook Zero-Day: Which Patches Should You Apply Before November 24? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft and CISA identify CVE-2026-124194 as an actively exploited Outlook vulnerability that can expose a user’s NTLMv2 hash when a crafted file is opened. Microsoft’s November 10 Office updates contain the fix, and U.S. federal civilian agencies must apply mitigations by November 24; CISA urges other organizations to prioritize remediation too.
Microsoft Outlook flaw CVE-2026-124194 is being exploited, and U.S. federal civilian agencies have until November 24, 2026, to apply available fixes, according to the U.S. Cybersecurity and Infrastructure Security Agency. Microsoft says opening a specially crafted file in an affected Outlook version can cause a connection to an attacker-controlled server and expose the user’s NTLMv2 hash, a credential-related proof that could be used to authenticate as that user.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on November 10, citing evidence of active exploitation. Its entry gives federal civilian agencies a November 24 due date and instructs them to apply vendor mitigations, or discontinue use of a product if mitigations are unavailable. Microsoft has issued updates for affected Office products; its security entry lists no workaround.
Microsoft rates the flaw Moderate, with a CVSS score of 6.5 out of 10. The described attack requires an unauthenticated attacker to send a malicious Office file and persuade a user to open it. Microsoft says the Outlook Preview Pane is not an attack vector. The flaw does not itself provide code execution, but the exposed hash could, in Microsoft’s words, let an attacker “authenticate as the user.”
For Office LTSC, Microsoft identifies build 16.0.14334.21048 for Office LTSC 2021 and build 16.0.17932.21140 for Office LTSC 2024 as fixed versions. Microsoft 365 Apps users should check the November 10 update for their channel. Listed builds include Current Channel Version 2610, build 20527.20196; Monthly Enterprise Channel Version 2610, build 20527.20194; and Semi-Annual Enterprise Channel Version 2610, build 20527.20192. The source material also lists Monthly Enterprise 2609, build 20430.20264, and 2608, build 20326.20320, and Semi-Annual Enterprise 2609, build 20430, but does not provide the complete build number for that last entry.
Outlook Zero-Day Patch Before November 24
CVE-2026-124194 is actively exploited. Check affected Office builds and apply Microsoft’s update; the deadline applies to U.S. federal civilian agencies.
What the flaw can expose
Opening a crafted file in affected Outlook can connect to an attacker-controlled server and expose a user’s NTLMv2 hash.
An unauthenticated attacker sends a malicious Office file.
The described attack requires user interaction. Preview Pane is not an attack vector.
The hash could let an attacker authenticate as the user; successful account access is not confirmed.
Fixed Office LTSC builds
Install the listed fixed version for the affected product and edition.
| Product | Fixed build |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
Microsoft 365 Apps versions listed
Check the November 10 update for your channel and verify the installed build.
Current Channel
Version 2610, build 20527.20196.
Monthly Enterprise
Version 2610, build 20527.20194. Also listed: 2609 build 20430.20264 and 2608 build 20326.20320.
Semi-Annual Enterprise
Version 2610, build 20527.20192. Version 2609 is listed, but its full build number is not provided.
Who must act by the deadline?
CISA’s directive sets different expectations for federal agencies and other organizations.
- Apply the available vendor update by November 24, 2026.
- If mitigation is unavailable, the directive says to discontinue use.
- The date is not a general regulatory deadline.
- CISA encourages prioritizing KEV vulnerabilities through risk-based vulnerability management.
Why the Hash Exposure Matters
The immediate risk is credential exposure through an Outlook file, not direct code execution. A stolen NTLMv2 hash may give an attacker a way to authenticate as the affected user, potentially creating a foothold on a workplace network. The consequences depend on the account’s access and the organization’s other security controls; the source material does not establish that every exposed hash can be used successfully.
The requirement to open the file means the described attack depends on user interaction. That does not remove the need to patch: Microsoft says the ordinary external-content warning is not shown for the connection, and CISA has confirmed evidence of exploitation. For organizations, checking installed Office builds and deploying the applicable update is the practical response because Microsoft lists no workaround.
The November 24 date has different force for different readers. It is a binding deadline for U.S. federal civilian executive-branch agencies under CISA’s directive. For private organizations and other users, it is not a regulatory deadline, but CISA recommends prioritizing vulnerabilities in the KEV catalog through risk-based vulnerability management.
Products Worth Considering
EcoFlow DELTA 3 Classic Solar Generator with 220W Solar Panel
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
How CISA Set the Deadline
CISA’s November 10 notice added six vulnerabilities to the KEV catalog across products from Microsoft, Cisco, Barracuda Networks, Openwave and Google Chromium. The agency said the additions were “based on evidence of active exploitation.” The Outlook entry is named “Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability,” reflecting the concern that Outlook does not warn before the potentially unsafe connection.
The catalog deadline comes from CISA’s directive for federal civilian executive-branch agencies, not a general order covering all organizations. CISA’s notice explicitly says the directive applies only to those agencies and separately encourages all organizations to prioritize KEV vulnerabilities. Microsoft’s affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions.
CISA’s record marks ransomware use as unknown. It also does not mark the flaw for forensic triage under the directive. Those fields do not show that exploitation has not occurred; the agency’s catalog addition says there is evidence of active exploitation. Microsoft classifies the issue as a spoofing vulnerability, while the described security consequence is disclosure of the user’s NTLMv2 hash.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its security guidance for CVE-2026-124194
What Is Not Yet Known
The available information does not identify who is behind the attacks, which people or organizations were targeted, how many may have been affected, or when exploitation began. CISA lists use in ransomware campaigns as unknown. The fact that the flaw is in the KEV catalog confirms evidence of active exploitation, but the supplied material does not detail the incidents behind that assessment.
The material also does not establish whether attackers successfully used any exposed hashes to access accounts or networks. Microsoft describes what an attacker could do with the hash, not a confirmed outcome for each victim. The full list of Microsoft 365 Apps channel builds is incomplete in the source material, so administrators should verify the applicable fixed version against Microsoft’s current update guidance rather than infer missing build numbers.
Check Office Builds Before November 24
Federal civilian agencies must meet CISA’s November 24, 2026, deadline by applying the available vendor update or following the directive’s instruction to discontinue use if mitigation is unavailable. Microsoft’s entry lists updates as the fix and no workaround. Other organizations should prioritize installing the update and confirm that deployed Office installations have reached the fixed build for their product and Microsoft 365 Apps channel.
Administrators should verify versions on affected devices rather than assume updates have installed simply because Office’s update policy is enabled. Users and IT teams can consult Microsoft’s Security Update Guide and channel-specific release information for the correct build. Further details about the attacks, affected targets and any confirmed account misuse have not been provided in the source material.
Key Questions
Which Outlook vulnerability is being exploited?
CVE-2026-124194, which Microsoft calls the Microsoft Outlook Spoofing Vulnerability, is listed by CISA as actively exploited.
What should Office LTSC users install?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed builds. Check Microsoft’s guidance for the applicable product and edition.
What is the deadline to apply the fix?
November 24, 2026, is the CISA deadline for U.S. federal civilian executive-branch agencies. CISA encourages other organizations to prioritize KEV vulnerabilities, but the cited directive does not impose this deadline on them.
Does opening Outlook’s Preview Pane trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says the attack requires a user to open a specially crafted file in an affected Outlook version.
Is there a workaround if an update cannot be installed?
Microsoft’s entry lists no workaround; the update is the fix. CISA’s directive says covered federal agencies should discontinue use of a product if mitigations are unavailable.
Source: ThorstenMeyerAI.com
