Microsoft fixes an Outlook flaw already used to leak Windows login hashes
November 10, 2026 (November 10, 2026)
Microsoft's November 10 updates fix more than a thousand flaws, and one of them, an Outlook flaw tracked as CVE-2026-124194, was already being exploited. An attacker sends a specially made message file and persuades the victim to open it in Outlook. Outlook then connects to a network location the attacker controls without its usual warning about external content, which can expose the user's NTLMv2 password hash, and that hash can be used to impersonate the user. Opening the file is required, and the preview pane is not a way in. Microsoft rates it as a spoofing flaw with a severity of 6.5. Affected versions are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, and the fixed builds include 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. CISA added it to its exploited-vulnerabilities list the same day. No attacker or victim has been named.
Why it matters
Outlook is on most office computers, and a stolen login hash can open other systems without the attacker ever knowing the password.
What defenders can take from it
- Install the November Office updates and check the installed Outlook build, not just the deployment report.
- Do not open message files you did not expect, even if they look like they come from a colleague.
- IT teams: limit outgoing NTLM traffic to the internet where you can.