I’M UNDER A CYBER ATTACK

Alert

Logo de Microsoft

Alert 2026-164 Actively exploited Outlook flaw exposes NTLM hashes

Affected product(s): 

ProductAffected versionsFixed in
Microsoft 365 Apps for Enterprise (32- and 64-bit)Earlier than the November update for the channel in useThe November update for each channel; for example, Current Channel 2610, build 20527.20196
Office LTSC 2021 (32- and 64-bit)Earlier than 16.0.14334.2104816.0.14334.21048 or later
Office LTSC 2024 (32- and 64-bit)Earlier than 16.0.17932.2114016.0.17932.21140 or later

Office 2019 and the Mac editions are not listed in this advisory.

Description

A vulnerability has been published in Microsoft Outlook, identified as CVE-2026-124194, released on Nov 10, 2026 at 1:00 p.m. (PYT) together with the November security updates. The vendor rates it CVSS 6.5, medium (Moderate). This bulletin treats it as high severity because of the active exploitation the vendor itself confirms. This CVE was already covered, together with the rest of the November batch, in Alert 2026-151.

According to the vendor, an unauthenticated attacker sends a crafted message file and convinces the user to open it in an affected Outlook client. Opening the file causes the client to connect to an attacker-controlled network location without displaying the usual external-content warning, and to disclose the user’s NTLMv2 hash, which can be used to authenticate as that user, in a relay attack against other services, or for offline password cracking. Exploitation requires user interaction and network connectivity. The Preview Pane is not a vector for this vulnerability. The impact is on confidentiality; the vendor does not describe code execution or a direct effect on integrity or availability.

The vendor marks it as Exploitation Detected: it is being exploited in real attacks, not only in theory. The vendor did not treat it as publicly disclosed before the patch. It did not identify an actor, victims, scale, or infrastructure, and no verified public proof of concept was found. As of Nov 10, 2026 at 4:03 p.m. (PYT), it appears in catalogs of exploited vulnerabilities. Researchers note that it may be useful both to opportunistic attackers and to targeted campaigns.

This vulnerability affects the Outlook client, not Exchange Server, and is unrelated to the Microsoft 365 and Exchange Online service disruption of Nov 12, 2026. Its CVSS score is 6.5 because the user must open the file; however, the missing warning allows the NTLMv2 hash to leak, and the vendor confirms it is being exploited.

Mitigation

The vendor did not publish an official workaround. The only measure that closes the flaw is to install the November 2026 updates and verify the build on each device, from the endpoint-management console or in File > Office Account in Outlook.

General recommendations

The following measures are not vendor guidance for this CVE and do not replace the patch:

  • Block outbound SMB to the Internet (TCP 445 and UDP 137–139) on the perimeter firewall and on the endpoints. Exposure can be checked from a user workstation with Test-NetConnection to an external host on port 445: if the connection succeeds, there is exposure.
  • Restrict NTLM: add privileged accounts to the Protected Users group; apply the policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers, starting in audit mode; require SMB signing and LDAP signing or EPA to make relay more difficult.
  • While patching, quarantine or block .msg and .eml attachments from external senders, and tell users not to open unexpected attached message files.
  • If exploitation is suspected, rotate the passwords of accounts with Outlook SMB or NTLM connections to external destinations and review their subsequent activity. The patch does not undo a prior compromise.

These measures do not replace the update.

Detection

The vendor did not publish indicators of compromise. The following searches are general detection recommendations, not official indicators:

  • In EDR, firewall, or proxy logs, outbound SMB or WebDAV connections from OUTLOOK.EXE to public IP addresses.
  • NTLM authentications to external destinations (events 8001 and 8003 in the NTLM/Operational log, with auditing enabled).
  • Unusual network logons with the same accounts after those connections.

Solution

The solution is to install the November 2026 security updates for Microsoft 365 Apps for Enterprise and for Office LTSC 2021 and 2024, and to verify the installed build on each device: on Office LTSC 2021, 16.0.14334.21048 or later; on Office LTSC 2024, 16.0.17932.21140 or later; on Microsoft 365 Apps, the November update for the channel in use (for example, Current Channel 2610, build 20527.20196).

For information on how to update, visit the following link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

Additional information: