An actively exploited vulnerability that steals NTLM in Outlook

Microsoft fixed a vulnerability in Outlook with the November 2026 security updates that could allow a user’s authentication credentials to leak. Tracked as CVE-2026-124194, the flaw targets users who open a specially crafted message file prepared by an attacker. CISA added the issue to its Known Exploited Vulnerabilities (KEV) list on November 10, 2026, and set November 24 as the deadline for organizations.

How does the attack work?

According to Microsoft Security Response Center (MSRC), the attacker sends a specially crafted message file and convinces the user to open it in Outlook. When the file is opened, Outlook skips the external content warning that would normally be shown and connects to a network address controlled by the attacker. At that point, the user’s NTLMv2 hash is exposed to the attacker, who can then authenticate as the user with that hash. So this is not a case of a password being stolen, but rather the compromise of proof of authentication.

Affected versions

According to the NVD entry, the affected products are Microsoft 365 Apps for enterprise (x64 and x86), Office 2021 LTSC, and Office 2024 LTSC. The preview pane is not an attack vector; simply seeing the message in the list does not cause harm, the file has to be opened. MSRC also emphasizes this point because the risk is still high for users who are in the habit of opening email attachments.

Score and assessment

Microsoft classified the vulnerability as Moderate, with a CVSS 3.1 score of 6.5 and the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The attack can be carried out over the network, requires no special privileges, and the only condition is that the user opens the file. Even so, the MSRC entry carries the “Exploitation Detected” label, and the vulnerability was exploited before it was publicly disclosed. CISA adding the issue to KEV also confirms that it is being used in the wild.

What should you do?

Microsoft 365 users should install the version delivered through their update channel. Office 2021 and Office 2024 LTSC users need to download and apply the November 2026 security update from the Microsoft Update Catalog. In organizations, the version inventory of Outlook clients should be checked, and message files from unfamiliar sources should not be opened. If a suspicious file has been opened, it makes sense to review the account’s active sessions and change the password; when an NTLM hash has leaked, a password change alone may not be enough, so it is important to report the incident to the security team.

Source: CISA KEV · NVD