🔍 Read the full analysis: Outlook Zero-Day Patch Prep: A Guide For The November 24 Deadline on ThorstenMeyerAI.com
TL;DR
Microsoft says attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash after they open a malicious file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 deadline for U.S. federal civilian agencies to apply the available Office updates. The attacker, targets and scale of exploitation have not been identified in the cited material.
Microsoft says attackers are exploiting CVE-2026-124194, an Outlook vulnerability that can expose a user’s NTLMv2 hash when they open a specially crafted file. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026, and federal civilian agencies must apply the available fix by Nov. 24.
The flaw, identified by Microsoft as the Microsoft Outlook Spoofing Vulnerability, can make Outlook connect to a location controlled by an attacker without showing the usual external-content warning. Microsoft says the connection may disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user. The attack requires a recipient to open a malicious file; Microsoft says the Preview Pane is not an attack vector.
Microsoft rates the vulnerability Moderate, with a CVSS score of 6.5 out of 10. Its description says an attacker does not need to be authenticated, but must send a specially crafted Office file and persuade a user to open it. The reported issue concerns disclosure of authentication information; the source material does not say that the flaw enables code execution.
Microsoft lists Office LTSC 2021 and 2024 and Microsoft 365 Apps for Enterprise among the affected products, in both 32-bit and 64-bit editions. The fixed builds specified in the source are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps has fixed builds by update channel; administrators should compare installed versions with Microsoft’s November 10 security release rather than assume every installation updated automatically.
Outlook zero-day Patch before November 24
Microsoft says attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Federal civilian agencies have a remediation deadline; other organizations should check their Office updates promptly.
How the flaw works
Exploitation requires a recipient to open a specially crafted file.
Microsoft says the Preview Pane alone is not an attack vector.
The flaw can make Outlook connect to an attacker-controlled location without the usual warning.
An attacker could use the NTLMv2 hash to authenticate as the user.
Who must act by the deadline?
CISA’s directive sets the binding date for federal civilian executive branch agencies.
- Apply the available Office updates by November 24.
- Verify affected installations reach the fixed build.
- The cited federal deadline is not binding on them.
- CISA recommends prioritizing KEV-listed vulnerabilities.
Check affected Office builds
Compare installed versions with Microsoft’s November 10 security release.
| Product | Fixed build | Next step |
|---|---|---|
| Office LTSC 2021 | 16.0.14334.21048 | Verify installation |
| Office LTSC 2024 | 16.0.17932.21140 | Verify installation |
| Microsoft 365 Apps | Channel-specific | Check the applicable release build |
Why the Hash Exposure Matters
The flaw matters because a stolen authentication hash can give an attacker a way to impersonate a user, potentially creating a foothold in an organization’s systems. Microsoft says the attacker could use the disclosed hash to authenticate as the user. The source material does not establish that every exposed hash can be reused successfully, or that attackers have used this flaw to access particular networks.
The condition for exploitation also shapes the immediate response: a user must open the crafted file, while Microsoft says previewing it is not enough. That does not remove the need to patch. Microsoft lists no workaround, so applying the relevant Office update is the stated remedy. CISA’s catalog identifies active exploitation, but does not establish the campaign’s reach or whether it is tied to ransomware.
The Nov. 24 deadline is binding for U.S. federal civilian executive branch agencies under the directive cited by CISA. Other organizations are not covered by that deadline, but CISA recommends prioritizing vulnerabilities in the KEV catalog through risk-based vulnerability management. For businesses and other Outlook users, the federal date is a prompt to check patch status, not a legal deadline under the cited directive.
Popular right now
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Ninja Air Fryer XL with MaxCrisp, 6.5 Qt, 6-in-1, Dark Grey (AF181)
Ninja Foodi 6-in-1 DualZone Air Fryer, 8 qt, Grey (DZ201)
As an affiliate, we earn on qualifying purchases.
How CISA Set the Deadline
CISA added six vulnerabilities to its KEV catalog on Nov. 10, 2026, saying the additions were based on evidence of active exploitation. The Outlook issue appears under the catalog name “Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability.” Its entry sets the remediation date as Nov. 24 and directs agencies to apply mitigations under vendor instructions, or discontinue use of a product if mitigations are unavailable.
For this Outlook flaw, Microsoft has released updates and lists no workaround or separate mitigation. CISA’s directive, BOD 26-04, applies to federal civilian executive branch agencies, not all public- or private-sector organizations. CISA nevertheless encourages other organizations to prioritize KEV-listed vulnerabilities. The source material says the flaw was the only vulnerability in Microsoft’s November release marked “Exploitation Detected”; that label and the KEV listing indicate exploitation, but do not identify who is responsible.
„The attacker could use this to authenticate as the user.“
— Microsoft, in its security update entry for CVE-2026-124194
What Is Known About Attacks
The cited information does not identify who is behind the exploitation, which people or organizations have been targeted, how many may have been affected, or when attacks began. CISA’s catalog lists ransomware use as “Unknown.” Its entry also does not mark this flaw for forensic triage under the directive, but that status is not evidence that no compromise has occurred.
Microsoft and CISA describe the vulnerability and active exploitation, but the source material provides no public incident count or detailed account of observed attacks. It is also not clear how many affected Office installations remain unpatched. The available information therefore supports treating the flaw as active and patching it, without drawing conclusions about the scale or impact of any campaign.
Check Office Builds Before Nov. 24
Federal civilian agency IT teams should verify that affected Office installations have reached the fixed build for their product and Microsoft 365 Apps update channel before the Nov. 24, 2026, deadline. Microsoft’s listed fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, administrators should consult Microsoft’s Nov. 10 release details for the build applicable to each channel; the source material identifies channel-specific versions and builds but does not provide a complete list.
Organizations outside the federal directive can use the same catalog entry and Microsoft guidance to prioritize remediation. Since Microsoft lists no workaround, the next practical step is to confirm the update has installed rather than rely on a deployment policy or assume that Office updated on its own. Further details about the attackers, targets and scope of exploitation may emerge, but no additional incident information or deadline change is confirmed in the cited material.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook vulnerability that Microsoft calls the Outlook Spoofing Vulnerability. Microsoft says opening a specially crafted file can cause Outlook to connect to an attacker-controlled location and disclose the user’s NTLMv2 hash.
Does opening a file have to happen for the attack to work?
According to Microsoft, an attacker must persuade a user to open a malicious Office file. Microsoft says the Preview Pane is not an attack vector.
Who must meet the Nov. 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under CISA directive BOD 26-04. CISA recommends that other organizations prioritize KEV-listed flaws, but the cited directive does not make this deadline binding on them.
What should affected organizations do?
Install the applicable Microsoft Office update and check that devices are running a fixed build. Microsoft lists no workaround; Microsoft 365 Apps build numbers vary by update channel.
Do officials know who is being targeted?
The cited information does not identify the attackers, targets, number of victims or start date of exploitation. CISA also lists use in ransomware campaigns as unknown.
Source: ThorstenMeyerAI.com
