CVE-2026-124194: Outlook Spoofing Flaw Exploited as a Zero-Day, Added to CISA KEV

CISA added CVE-2026-124194, a Microsoft Outlook spoofing flaw, to the Known Exploited Vulnerabilities (KEV) catalog on Tuesday, November 10, 2026, the same day Microsoft shipped the fix. Microsoft's data says exploitation was detected and the flaw was not publicly disclosed when the update went out. Opening a crafted message file can make Outlook connect to an attacker-controlled location without the usual external-content warning, which leaks the user's NTLMv2 hash. The score is 6.5 Medium and remediation is due November 24.

What the flaw does

Microsoft describes a spoofing flaw in which the product user interface does not warn the user of unsafe actions (CWE-356). In its security update guide FAQ, an unauthenticated attacker sends a specially crafted message file and convinces the user to open it in an affected version of Outlook. Opening it can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. That connection discloses the user's NTLMv2 hash, which Microsoft says the attacker could use to authenticate as the user. Exploitation needs network connectivity and user interaction, and Microsoft states that the Preview Pane is not an attack vector.

Two details are missing. Microsoft calls the trigger a "specially crafted message file" in one answer and a "malicious Office file" in another, and it names neither the file type nor the protocol Outlook uses for the outbound connection. The advisory page itself renders only with JavaScript, so we read the same data from Microsoft's data endpoint and the CVE record, and they agree.

On exploitation, Microsoft's data reads Exploitation Detected: Yes and Publicly Disclosed: No as of the November 10 release, and CISA's SSVC entry reads Active. KrebsOnSecurity, Qualys and Cyber Security News call it a zero-day, a word Microsoft's data does not use. No source names the attacker, the victims, the scale or any indicators of compromise, and the advisory data we read credits no reporter.

Who is affected

The CVE record lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in 32-bit and 64-bit builds. Office 2019 is not on the affected list. Microsoft's CVE record gives fixed builds for the two LTSC products only, and gives a link in place of a build for 365 Apps. The 365 Apps rows below come from Microsoft's November 10 release notes, which list this CVE under Outlook, so treat them as the release that carries the fix.

The fixed builds come from Microsoft's CVE record and its Microsoft 365 Apps security update notes. The sources do not say whether Outlook outside the listed Office products is affected.

A Medium score on a flaw that hands over a hash

Microsoft's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, which gives 6.5. Only confidentiality counts, and the user interaction requirement pulls the number down. The temporal part of the same vector marks exploit code maturity High and the official fix as available, and it only brings the score to 6.2. What the attacker can do with the hash, authenticate as the user according to Microsoft, is not in the number.

The data points the other way. The listing shows EPSS at 1.6%, which VulnTracker places above 76% of all CVEs, and SSVC reads Active. The contrast with an older Outlook hash leak is the interaction. Rapid7's analysis of CVE-2023-23397, patched on March 14, 2023, says a crafted message file triggered the NTLM connection even if the email was never viewed in the Preview Pane. This flaw needs the user to open the file, and the Preview Pane is excluded. That single click is the gap between a flaw you can only patch and one where user behavior and attachment handling also count. Rank it by the KEV flag, not by the 6.5.

Reading it on VulnTracker

Two things to read with care. The 365 Apps range shows a link where a build number should be, which mirrors Microsoft's own record, so use the release notes above for builds. The remediation section's fixed versions are VulnTracker's inference from the affected ranges, and the guide field is empty, so the fixes in this post come from Microsoft's data. The Newsroom tab lists 8 items and the Exploits tab lists 2, which we did not review.

What to do

1. Install the November 10 Office updates. Move Microsoft 365 Apps to the build for your channel in the table above, and LTSC 2021 and LTSC 2024 to 16.0.14334.21048 and 16.0.17932.21140 or later. Confirm the build under File, Office Account in Outlook.
2. Tell users not to open unexpected message files. Microsoft does not name the file type, so as a suggestion of our own, review whether your mail gateway lets message-file attachments through from external senders.
3. Limit outbound authentication traffic. Rapid7's guidance for the 2023 Outlook hash leak, and the Daily CyberSecurity write-up of this one, both point to blocking outbound SMB, TCP 445, to the internet and limiting outbound NTLM. This is not Microsoft guidance for this CVE, and because Microsoft does not name the protocol, a port 445 block may not cover every path.
4. Hunt for exposure. Microsoft published no indicators of compromise, so as our own suggestion, look for connections from OUTLOOK.EXE to external addresses after a user opened a message file, and for unfamiliar sign-ins to the account of anyone who did. If a user opened a suspicious file, resetting their password invalidates a captured hash.
5. Federal civilian agencies follow the required action in the KEV entry, with a due date of November 24. Everyone else can adopt the same date.

Takeaway

This flaw is exploited, patched and rated Medium, and the first two facts decide the order of work. The fix is in the November 10 Office update, and the open questions are who is using it, against whom and through which file type. Microsoft has not said. Patch now, and do not wait for those answers. To follow this CVE and the next KEV addition, add Outlook to your Track List on VulnTracker.

References

• Microsoft security update guide, CVE-2026-124194
• Microsoft 365 Apps security update release notes
• Cyber Security News, CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability
• Qualys, Microsoft Patch Tuesday November 2026 Security Update Review
• Daily CyberSecurity, Outlook zero-day CVE-2026-124194
• Rapid7, analysis of CVE-2023-23397
• CVE.org record for CVE-2026-124194
• NVD entry for CVE-2026-124194
• CISA KEV entry for CVE-2026-124194