{"id":12619,"date":"2026-11-12T16:13:56","date_gmt":"2026-11-12T22:13:56","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-164-active-exploitation-of-outlook-vulnerability-exposing-ntlm-hashes\/"},"modified":"2026-11-12T16:35:05","modified_gmt":"2026-11-12T22:35:05","slug":"alert-2026-164-actively-exploited-outlook-flaw-exposes-ntlm-hashes","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-164-actively-exploited-outlook-flaw-exposes-ntlm-hashes\/","title":{"rendered":"Alert 2026-164 Actively exploited Outlook flaw exposes NTLM hashes"},"content":{"rendered":"\n

Affected product(s): <\/h2>\n\n\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed in<\/strong><\/td><\/tr>
Microsoft 365 Apps for Enterprise (32- and 64-bit)<\/strong><\/td>Earlier than the November update for the channel in use<\/td>The November update for each channel; for example, Current Channel 2610, build 20527.20196<\/td><\/tr>
Office LTSC 2021 (32- and 64-bit)<\/strong><\/td>Earlier than 16.0.14334.21048<\/td>16.0.14334.21048 or later<\/td><\/tr>
Office LTSC 2024 (32- and 64-bit)<\/strong><\/td>Earlier than 16.0.17932.21140<\/td>16.0.17932.21140 or later<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Office 2019 and the Mac editions are not listed in this advisory.<\/p>\n\n\n\n

Description<\/h2>\n\n\n\n

A vulnerability has been published in Microsoft Outlook, identified as CVE-2026-124194, released on Nov 10, 2026 at 1:00 p.m. (PYT) together with the November security updates. The vendor rates it CVSS 6.5, medium (Moderate). This bulletin treats it as high severity because of the active exploitation the vendor itself confirms. This CVE was already covered, together with the rest of the November batch, in Alert 2026-151<\/a>.<\/p>\n\n\n\n

According to the vendor, an unauthenticated attacker sends a crafted message file and convinces the user to open it in an affected Outlook client. Opening the file causes the client to connect to an attacker-controlled network location without displaying the usual external-content warning, and to disclose the user’s NTLMv2 hash, which can be used to authenticate as that user, in a relay attack against other services, or for offline password cracking. Exploitation requires user interaction and network connectivity. The Preview Pane is not a vector for this vulnerability. The impact is on confidentiality; the vendor does not describe code execution or a direct effect on integrity or availability.<\/p>\n\n\n\n

The vendor marks it as Exploitation Detected: it is being exploited in real attacks, not only in theory. The vendor did not treat it as publicly disclosed before the patch. It did not identify an actor, victims, scale, or infrastructure, and no verified public proof of concept was found. As of Nov 10, 2026 at 4:03 p.m. (PYT), it appears in catalogs of exploited vulnerabilities. Researchers note that it may be useful both to opportunistic attackers and to targeted campaigns.<\/p>\n\n\n\n

This vulnerability affects the Outlook client, not Exchange Server, and is unrelated to the Microsoft 365 and Exchange Online service disruption of Nov 12, 2026. Its CVSS score is 6.5 because the user must open the file; however, the missing warning allows the NTLMv2 hash to leak, and the vendor confirms it is being exploited.<\/p>\n\n\n\n

Mitigation<\/h2>\n\n\n\n

The vendor did not publish an official workaround. The only measure that closes the flaw is to install the November 2026 updates and verify the build on each device, from the endpoint-management console or in File > Office Account in Outlook.<\/p>\n\n\n\n

General recommendations<\/strong><\/p>\n\n\n\n

The following measures are not vendor guidance for this CVE and do not replace the patch:<\/p>\n\n\n\n