Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user [1][2]. Microsoft says the flaw has been exploited but gives no details on the attacks, and CISA added it to the Known Exploited Vulnerabilities catalog on November 10 [1][3]. Organizations running Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 should install the November security update now and warn users not to open unexpected message files [1][2].
Opening a crafted message file makes Outlook skip the external-content warning and leak NTLMv2 hashes; zero-day CVE-2026-124194 exploited and added to KEV
1 min read
- Disclosed
- Nov 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 1.6%, higher than 76% of CVEs
- Exploitation and patch status
- ExploitedKEVPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Microsoft Outlook（Microsoft 365 Apps for Enterprise、Office LTSC 2021、Office LTSC 2024）
What to do nowOur advice
Organizations running Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 should install the November security update now and warn users not to open unexpected message files
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Microsoft Outlook（Microsoft 365 Apps for Enterprise、Office LTSC 2021、Office LTSC 2024） | 2026 年 11 月更新前[1] | 2026 年 11 月安全更新 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
- 1Install the November security update patch[1]
Install the November update for Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
- 2Warn users not to open suspicious message files mitigate[1]
The flaw requires the user to open a crafted message file; the Preview Pane does not trigger it.
References
Official / primary1
- [3]
“Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.”
Media2
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.