Microsoft

Opening a crafted message file makes Outlook skip the external-content warning and leak NTLMv2 hashes; zero-day CVE-2026-124194 exploited and added to KEV

Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

On July 20, 2025, CISA added CVE-2025-53770 ('ToolShell') in on-premises Microsoft SharePoint to its Known Exploited Vulnerabilities (KEV) catalog .