“Medium”: the user has to interact, and only confidentiality is affected. [1]
Vulnerability · actively exploited
Outlook zero-day CVE-2026-124194Opening a single file is enough to send Windows credentials to attackers
On November 10, 2026, Microsoft closed a flaw in classic Outlook for Windows that is already being exploited in attacks. If a user opens a crafted message file, Outlook connects to an attacker-controlled server without the usual warning and discloses the account’s NTLMv2 hash in the process. The US agency CISA added the flaw to its catalog of exploited vulnerabilities that same day. The CVSS score of 6.5 sounds harmless. The situation is not.
- CVSS 6.5 · exploited
- In CISA KEV since November 10, 2026
- Deadline for US federal agencies: November 24, 2026
- Fix in the November Office update
At a glance
What happened and what it means for you
On the November Patch Tuesday, Microsoft closed more than a thousand vulnerabilities. According to Microsoft, only one of them is already being exploited: CVE-2026-124194 in classic Outlook for Windows. It does not give attackers access to the computer, but it gives them something that is worth almost as much in many networks: usable credentials of the user. [1][2][9]
- The attack needs one click. Attackers send a crafted message file and get the user to open it in Outlook. According to Microsoft, the preview pane is not an attack vector.
- Outlook does not warn. When the file is opened, Outlook connects to a network destination controlled by the attackers without displaying the usual notice about external content.
- The hash is the prize. In the process, the user’s NTLMv2 hash is sent to the attackers. They can crack it offline or relay it to other services and thus impersonate the user.
- Authorities classify the flaw as urgent. CISA has listed it in its catalog of known exploited vulnerabilities since November 10; US federal agencies must act by November 24.
- The patch is an Office update. Windows Update alone is not enough. What matters is the installed Outlook build, not the deployment status in the console.
What is established
- Microsoft confirms exploitation (“Exploitation Detected”); the flaw was not publicly known before the patch.
- Affected are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, each in 32-bit and 64-bit.
- Microsoft does not list the new Outlook, Outlook on the web, Outlook for Mac or the mobile apps as affected.
- It is the only exploited flaw in the November update.
- Microsoft names “nono” and Benoit Sevens as the finders, the latter with the note “using Claude with Anthropic”.
What remains unclear
- Who is exploiting the flaw and against whom: Microsoft names neither actors nor targets.
- How many attacks there have been and since when.
- Indicators of compromise (IOCs) have not been published so far.
- Which file format the attackers use and which protocol Outlook uses to connect.
- Whether the proof-of-concept code that has surfaced on GitHub works; none of it has been verified.
Attack chain
How a file turns into a stolen account
Microsoft itself describes the first three steps. Steps four and five show how, in our experience, attackers use captured NTLMv2 hashes. This is our assessment, not a statement about the current attacks.
- According to Microsoft
Lure
A crafted message file arrives as an email attachment, via a download link or through a file share. The sender usually poses as a known contact.
- According to Microsoft
Opening
The user opens the file in Outlook. Only this step triggers the attack; merely selecting it in the preview pane does not.
- According to Microsoft
Connection without warning
Outlook connects to an attacker-controlled server without warning about external content. Windows automatically authenticates to it.
- VamiSec assessment
Hash captured
The authentication transmits an NTLMv2 challenge-response. The attackers’ server records it; the user notices nothing.
- VamiSec assessment
Abuse
Weak passwords can be cracked offline. Alternatively, the authentication is relayed immediately to internal services (NTLM relay), such as Exchange, file servers or the certificate services.
What the flaw is not
- Not zero-click: nothing happens unless the file is opened. That distinguishes it from CVE-2023-23397, which was triggered as soon as a message arrived.
- No code execution: attackers do not take over the computer directly; they capture credentials.
- No attack via the preview pane.
Why a hash is so valuable
- With the cracked password, attackers can sign in wherever the account is valid, including VPN and cloud services if no second factor is enforced there.
- With a relay, they do not even need the password: they forward the authentication as long as services accept NTLM without signing or channel binding.
- If an administrator account is hit, the entire Windows domain may be open to them in the worst case.
- Multi-factor authentication protects cloud services, but neither against cracking the hash nor against every internal relay path.
Timeline
Outlook, NTLM and the backstory
The current flaw is part of a series of attacks that capture Windows credentials via Outlook and File Explorer.
- Exploitation
- Vendor
- Exploitation
- Exploitation
- Vendor
Microsoft announces the end of NTLM
NTLM is to be disabled by default in the next major Windows releases. Current versions continue to support it; hardening remains the responsibility of organizations. [12]
- Exploitation
- Deadline
KEV catalog deadline
By then, US federal agencies must have installed the updates. For companies, it is a good benchmark. [4]
Affected versions
Which Outlook installations need the update
Classic Outlook for Windows from these Office suites is affected. The installed build is what counts: the flaw is closed as of the builds listed, and later builds contain the fix as well.
| Product | Channel or edition | Version | Build with fix |
|---|---|---|---|
| Microsoft 365 Apps for Enterprise | Current Channel | 2610 | 20527.20196 |
| Microsoft 365 Apps for Enterprise | Monthly Enterprise Channel | 261026092608 | 20527.2019420430.2026420326.20320 |
| Microsoft 365 Apps for Enterprise | Semi-Annual Enterprise Channel | 261026092608 | 20527.2019220430.2026220326.20318 |
| Office LTSC (volume licensing) | Office LTSC 2024 | 2408 | 16.0.17932.21140 |
| Office LTSC (volume licensing) | Office LTSC 2021 | 2108 | 16.0.14334.21048 |
For Microsoft 365 Apps, Microsoft does not state a fixed build number in the CVE entry but refers to the release notes for Office security updates; these values are taken from there. The Semi-Annual Enterprise Channel now receives the builds of the Monthly Enterprise Channel.
Build check
Select the channel, enter the build, see the result. You can find the build in Outlook under File › Office Account › About Outlook.
The check runs only in your browser; nothing is transmitted.
No build entered yet
The result appears as soon as you enter a build number.
- Fixed as of build
- 2610
20527.20196
Not listed as affected
- New Outlook for Windows
- Outlook on the web
- Outlook for Mac
- Outlook for iOS and Android
Microsoft does not list Office 2016 and Office 2019 for this flaw. Not listed does not mean verified as safe: if you run older versions, you should implement NTLM hardening with particular rigor.
For many computers: read the build with PowerShell
For Click-to-Run installations, the build is stored in the registry. For the entire fleet, Intune, Defender Vulnerability Management or the Microsoft 365 Apps admin center are suitable.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' |
Select-Object VersionToReport, UpdateChannel, CDNBaseUrlTrigger the update on a single computer right away
This command starts the update; Outlook must then be restarted.
& "$env:CommonProgramFiles\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update userSelf-check
How well are you protected against NTLM theft via Outlook?
Eight questions, answered honestly. “Yes” is always the safe answer. The evaluation stays in your browser.
Your result
0 of 8 questions answered
The self-check is no substitute for an assessment of your environment.
Action plan
What to do now
Three stages: close the flaw today, broaden your defenses by the KEV deadline, then phase out NTLM step by step. [12][13][18][19]
Close the flaw
- Deploy and enforce the Office update of November 10 on all computers with classic Outlook.
- Check the installed build, not just the deployment status.
- Block outbound TCP 445 to the internet, including on laptops outside the corporate network.
- Warn employees: do not open unexpected message files.
- Use the queries below to search for Outlook connections to external servers.
Broaden your defenses
- Add privileged accounts to the “Protected Users” group.
- Log outbound NTLM to external servers, then block it with an exception list.
- Enable SMB and LDAP signing, channel binding and Extended Protection.
- Disable the WebClient service on computers that do not need WebDAV.
- Inspect or hold back external message files at the mail gateway.
Phase out NTLM
- Enable enhanced NTLM auditing and evaluate it for a few weeks (Windows 11 24H2 or later, Windows Server 2025).
- Switch applications from hard-coded NTLM to Negotiate so that Kerberos is used.
- Stop authenticating via IP addresses and register missing SPNs.
- Block NTLM in rings, starting with the accounts most in need of protection.
- Document remaining exceptions and make them time-limited.
For IT operations and the SOC
- Report patch coverage daily until the deadline.
- Activate detection rules for SMB and WebDAV connections from Outlook.
- Monitor NTLM authentications from unusual sources on the domain controllers.
For executive management and the information security officer
- Set November 24 as the internal target and follow up on progress.
- Plan resources for phasing out NTLM: Microsoft will only disable NTLM in future versions.
- Clarify whether a suspected incident is reportable under NIS2 or DORA.
Suspect leaked credentials?
Report an incident csirt@vamisec.comReset the account’s password, revoke sessions and tokens, search for certificates issued to the account and block the remote host. Our CSIRT supports you around the clock.
Detection
Hunting for traces
Microsoft has not published any indicators. These queries help you find suspicious connections and sign-ins. They are examples for Microsoft Defender XDR, Microsoft Sentinel and Windows events; test them in your environment before use.
Outlook talks SMB to the internet
Connections from outlook.exe via port 139 or 445 to public addresses in the last 30 days.
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (139, 445)
| where RemoteIPType == "Public"
| summarize Connections = count(), FirstSeen = min(Timestamp),
LastSeen = max(Timestamp) by DeviceName, RemoteIP, RemotePortWebDAV as a fallback
If port 445 is blocked, Windows can fall back to WebDAV over HTTP. A typical sign is rundll32 with davclnt.dll.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_all ("davclnt.dll", "DavSetCookie")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileNameOutbound NTLM in the Windows log
If the NTLM policy is set to audit, Windows logs outbound authentications as event 8001, including the target server.
Get-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -MaxEvents 500 |
Where-Object Id -eq 8001 |
Select-Object TimeCreated, MessageSuspicious NTLM sign-ins
Network logons via NTLM (event 4624, logon type 3) from sources that are new for an account can indicate relaying or cracked passwords.
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4624 and LogonType == 3
| where AuthenticationPackageName == "NTLM"
| summarize Logons = count(), Sources = make_set(IpAddress, 20)
by TargetUserName, Computer
| order by Logons descHits are indications, not proof. If you find something, treat the account as compromised until proven otherwise.
NIS2 and DORA
What regulation says about it
The flaw alone is not a reportable incident. What attackers do with captured credentials, however, can become reportable.
- Handling vulnerabilities is mandatory
NIS2 requires essential and important entities to have risk management in place that includes vulnerability handling. Anyone who leaves an exploited flaw open for weeks may have to justify it.
- Reporting deadlines in an emergency
If the theft of credentials leads to a significant security incident, the following applies in Germany: early warning to the BSI within 24 hours, notification within 72 hours, final report one month later.
- Financial sector: DORA
Banks, insurers and other financial entities classify ICT incidents under DORA and report major ones to their supervisory authority. Compromised accounts belong in this assessment.
- Evidence instead of gut feeling
Auditors ask for evidence: when was the update deployed, which computers were missing, which exceptions were there? If you document this, you are prepared for audits and follow-up questions.
Learn moreImplementing NIS2 with VamiSec Implementing DORA with VamiSec Incident management based on ISO/IEC 27035
How VamiSec supports you
Check, harden, prove
From a short-notice exposure check to an orderly move away from NTLM.
Acute
CSIRT and Compromise Assessment
If you suspect an incident, we determine whether credentials were leaked and used, across endpoints, logs, identities and infrastructure.
Compromise AssessmentTest
Pentest focused on NTLM relay
We examine your Active Directory for relay paths, missing signing and accounts that would let a captured hash go a long way.
Penetration testingDetect
Managed Detection & Response
We monitor endpoints and identities and respond when Outlook establishes unusual connections or accounts behave suspiciously.
MDR at VamiSecPrevent
Zero-day monitoring
Newly disclosed and exploited vulnerabilities are matched against your attack surface around the clock, before patch cycles take effect.
Zero-day monitoringPeople
Security awareness with KnowBe4
Phishing simulations with attachments and short training sessions, so that suspicious files are reported instead of opened.
Security awarenessProcess
Vulnerability management
A process that handles KEV entries first, sets deadlines and justifies exceptions instead of just sorting by CVSS.
Vulnerability management
Agentic GRC platformVamiGRC: detect exploited vulnerabilities, manage deadlines, maintain evidence
VamiGRC matches CISA KEV, NVD and EPSS against your assets. When an exploited flaw such as CVE-2026-124194 appears, you see which of your recorded assets are affected and manage actions and deadlines through to evidence.
- CISA KEV, NVD and EPSS are matched against your assets, products and SBOMs.
- Evidence from connected systems is updated along with its source rather than at audit time.
- When an incident is recorded, a deadline timer starts for NIS2; VamiAI drafts notifications, and your team reviews and submits them.
- One control, multiple frameworks: implemented once, mapped to NIS2, ISO 27001 and other standards.
- AI agents handle the routine work according to your approval rules; your team decides.
Schedule a call
Let’s talk about your Outlook and NTLM situation
Whether it is an exposure check, NTLM hardening or evidence for NIS2, Valeri Milke and the VamiSec team help you derive concrete next steps from this briefing.
“IT security and compliance without AI is a vulnerability.”
Valeri MilkeFounder & Managing Director · VamiSec GmbHISO/IEC 27001 & ISO/IEC 42001 Lead Auditor
FAQ
Frequently asked questions about the Outlook zero-day
What is CVE-2026-124194?
A spoofing flaw in classic Outlook for Windows that Microsoft closed on November 10, 2026. If a user opens a crafted message file, Outlook connects to an attacker-controlled network destination without the usual warning and discloses the user’s NTLMv2 hash in the process. Microsoft rates the flaw at CVSS 6.5 (“Medium”) and confirms that it is being exploited.
Is this a zero-click attack?
No. The user has to open the file; according to Microsoft, the preview pane is not an attack vector. This was different in 2023 with CVE-2023-23397, which was triggered as soon as a message arrived.
Which Outlook versions are affected?
Classic Outlook for Windows in Microsoft 365 Apps for Enterprise and in Office LTSC 2021 and Office LTSC 2024, each in 32-bit and 64-bit. The fix is included in Office LTSC 2021 as of build 16.0.14334.21048, in Office LTSC 2024 as of 16.0.17932.21140 and in Microsoft 365 Apps as of the November builds of the respective channel, for example 20527.20196 in Current Channel. Microsoft does not list the new Outlook, Outlook on the web, Outlook for Mac or the mobile apps as affected.
Is Windows Update enough?
No. The flaw is in Office. What matters is the Office security update of November 2026, which Microsoft 365 Apps receive via their respective update channel. Check the installed build in Outlook under File › Office Account › About Outlook, or centrally via Intune or Defender Vulnerability Management.
Why is a flaw with CVSS 6.5 so urgent?
Because it is being exploited. CVSS describes technical severity, not the threat situation. CISA has added the flaw to its catalog of known exploited vulnerabilities and set US federal agencies a deadline of November 24, 2026. Earlier NTLM leaks with the same rating were also actively attacked.
What can attackers do with an NTLMv2 hash?
They can try to crack the password offline, which succeeds quickly with weak passwords. Or they relay the authentication directly to other services (NTLM relay), such as Exchange, file servers or Active Directory Certificate Services, and act there on behalf of the user. If the account is privileged, this can put the entire domain at risk.
Who is exploiting the flaw?
That is not known. Microsoft and CISA name neither actors nor targets, and no indicators have been published. Earlier Outlook flaws involving NTLM theft were exploited by, among others, the Russian group Forest Blizzard (APT28); no conclusions about the current case can be drawn from this.
What does Claude have to do with the discovery?
Microsoft credits Benoit Sevens with the addition “using Claude with Anthropic”, as well as a researcher going by the name “nono”. How exactly the AI model was involved has not been published. The case shows how AI is accelerating vulnerability research, for defenders and attackers alike.
Is there public exploit code?
At least two repositories promising a proof of concept have surfaced on GitHub; one is explicitly untested. Do not download such code without checking it: supposed exploits are regularly malware themselves.
How does VamiSec support you?
At short notice, we check whether your Outlook installations are patched and how far a captured hash would get in your network, harden NTLM, build detection rules and investigate suspected cases with a compromise assessment and our CSIRT. With VamiGRC, you manage exploited vulnerabilities, deadlines and evidence for NIS2.
Sources
Sources and further information
The information is based on publications by Microsoft, CISA, NIST and security researchers up to November 13, 2026. Assessments by VamiSec are identified as such.
- [1]Microsoft Security Response Center: CVE-2026-124194 – Microsoft Outlook Spoofing Vulnerability,
- [2]Microsoft Security Response Center: November 2026 Security Updates – Release Notes,
- [3]Microsoft Learn: Release notes for Microsoft Office security updates,
- [4]CISA: Known Exploited Vulnerabilities Catalog,
- [5]NIST National Vulnerability Database: CVE-2026-124194 Detail,
- [6]CVE Program: CVE Record CVE-2026-124194,
- [7]Cyber Security News: CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability,
- [8]Cyber Security News: Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes,
- [9]SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft,
- [10]Notebookcheck: Exploited Outlook zero-day was found by a researcher using Claude,
- [11]TheHackerWire: CVE-2026-124194: Vulnerability Details,
- [12]Microsoft Windows IT Pro Blog: Retiring NTLM: Frequently asked questions,
- [13]Microsoft Security Blog: Guidance for investigating attacks using CVE-2023-23397,
- [14]Check Point Research: The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture,
- [15]NIST National Vulnerability Database: CVE-2024-43451 Detail,
- [16]SecurityWeek: Windows Zero-Day Exploited by Russia Triggered With File Drag-and-Drop, Delete Actions,
- [17]Check Point Research: CVE-2025-24054, NTLM Exploit in the Wild,
- [18]Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
- [19]Microsoft Learn: Protected Users Security Group
- [20]NIST National Vulnerability Database: CVE-2025-24054 Detail,
- [21]FIRST: Exploit Prediction Scoring System (EPSS): CVE-2026-124194,
This briefing is no substitute for legal advice or an assessment of your environment.
Act nowPatching is mandatory.
Patching is mandatory.
Phasing out NTLM protects you from the next flaw.
Arrange a no-obligation initial consultation: together, we will clarify your patch status, hardening and the next steps.