93← Home

Microsoft Confirms Active Exploitation Of New Outlook Zero-Day

Headline from Forbes · compiled from 5 sources

Our analysis · checked against 10 sources

Microsoft patches Outlook flaw used in attacks to steal Windows login hashes

On November 10 Microsoft fixed CVE-2026-124194, an Outlook flaw with a CVSS score of 6.5 that leaks NTLM login hashes when a user opens a crafted message file; Microsoft and CISA say it is being exploited. Microsoft has not disclosed attackers, victims or scale, and reported totals for the month's fixes vary from 1,093 to 1,259.

What the headline leaves out

  • The attack needs a user to open a crafted message file; previewing it does not trigger it.
  • Installing Windows updates alone does not fix it; the Office or Microsoft 365 Apps update is required.
  • Its 6.5 score is below Critical; this is the third month running the exploited bug rated below Critical.
  • Five other Outlook fixes this month are not marked exploited.

What happens next

CISA requires US federal agencies to fix the flaw by November 24, 2026. TechRepublic notes organisations must confirm Office or Microsoft 365 Apps builds separately, since Windows updates alone do not fix it. Forbes and security experts warn stolen hashes can let an attacker authenticate as the user, a general risk rather than a reported case; Automox's Jon Levenson urges pushing the fix 'today'. Microsoft plans to require NTLM signing by default on Windows servers from May 2027.

Possible knock-on effects
  • A stolen hash from an administrator or finance user could let attackers authenticate as them, which may widen a breach well beyond one mailbox. (named expert: Jack Bicer, director of vulnerability research at Action1, says damage grows fast for such users. Watch for: Microsoft or CISA reports of follow-on account compromise or lateral movement, which Microsoft has not yet disclosed)
  • Organisations that rely on Windows cumulative updates could leave Outlook unpatched, which may keep them exposed past the federal deadline. (mechanism: The fix ships in the Office/Microsoft 365 Apps update, not the Windows update. Watch for: Whether installations reach Office LTSC 2021 build 16.0.14334.21048 and LTSC 2024 build 16.0.17932.21140 or later)

Sources: BleepingComputer: November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day, CyberPress: Microsoft patches over 1,093 security flaws, SOC Prime: CVE-2026-124194 Outlook zero-day, dev.to: Microsoft patches 1,259 flaws, SecurityWeek: Exploited Outlook zero-day among 1,094 flaws, Cryptika: Hackers exploiting Outlook 0-day, shattered.io: November 2026 Patch Tuesday, Forbes: Microsoft confirms active exploitation of new Outlook zero-day, Cybersecurity News: Outlook 0-day vulnerability, TechRepublic: Microsoft November 2026 Patch Tuesday

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

Forbes reports that Microsoft's Security Response Center has confirmed that attackers were already exploiting a new Outlook security vulnerability before Microsoft released a patch.[1] One security director told Forbes that organisations should "push the fix to your endpoints today."[1]

BleepingComputer reports that Microsoft's November 2026 Patch Tuesday fixed a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.[2] TechRepublic notes that Tenable's analysis counted 1,093 Microsoft CVEs.[3]According to BleepingComputer, the flaw is tracked as CVE-2026-124194 and was actively exploited in attacks to steal NTLM account hashes.[2] Microsoft warned that opening a crafted file "could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning."[2]Forbes reports that the flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024[1]. Jack Bicer of Action1 told Forbes that "this flaw turns one opened file into stolen identity."[1]TechRepublic, citing SecurityWeek, reports that Microsoft assigned the flaw a Moderate severity rating and a CVSS score of 6.5.[3] TechRepublic adds that simply receiving a malicious email does not trigger the vulnerability.[3]SOC Prime reports that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10[4] and set November 24 as the patch deadline for applicable US federal agencies.SecurityOnline reports that Microsoft has not said who is behind the attacks or how many targets were hit.[5]Forbes reports that Tyler Reguly of Fortra said "everyone should work to update Outlook as soon as possible."[1]

Listen to the songIT Security News — November 12, 2026

Sources

  1. [1]Microsoft Confirms Active Exploitation Of New Outlook Zero-Day
  2. [2]Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
  3. [3]Microsoft Patches 1,235 Security Flaws: Outlook Zero-Day Already Under Attack
  4. [4]CVE-2026-124194: Outlook Zero-Day Exposes NTLM Hashes
  5. [5]Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

Microsoft Confirms Active Exploitation Of New Outlook Zero-Day | 93