Outlook Zero-Day Exploited: 1,094 Flaws Patched by Microsoft

Microsoft says attackers have already exploited an Outlook zero-day, CVE-2026-124194, and fixed it in the November 2026 Patch Tuesday release. The flaw can leak a user's NTLMv2 hash after they open a booby-trapped message file. Patch your Office installs first, then tighten outbound NTLM and SMB traffic.

What happened

Microsoft's November 2026 updates fix 1,094 vulnerabilities across its products, according to SecurityWeek. One of them is an Outlook bug the company says has been exploited.

The flaw is classed as a spoofing issue. Outlook fails to warn the user before a potentially dangerous action takes place.

Here is the attack in Microsoft's words: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user."

Microsoft also clarified that the bug "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user."

Who is affected

The affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft's advisory credits a researcher using the name "nono" and Benoît Sevens with the discovery.

Check Microsoft's advisory for CVE-2026-124194 for the exact fixed build numbers for your update channel.

The Preview Pane cannot trigger the flaw. The user has to open the file.

How serious it is

Microsoft rates the bug moderate with a CVSS score of 6.5. That score looks calm next to the exploitation status. Microsoft says the bug has been exploited, and it was not publicly disclosed before the fix shipped.

A stolen NTLMv2 hash is not a plaintext password. Attackers can still use it to authenticate as the user in some setups, or try to crack it offline. Weak passwords and legacy NTLM use raise the risk.

The wider release is large. Windows accounts for 726 of the fixes and Office for 174. Microsoft also patched 59 flaws in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure and nine in Exchange Server.

Critical-severity updates cover Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge and the Malware Protection Engine. Microsoft has now fixed more than 5,000 vulnerabilities this year.

What to do now

1. Patch Office

Install the November 2026 Office updates on every affected install. Start with the machines of executives, finance staff and help desk, since attackers often target them first.

Check the installed build, then trigger an update on a Click-to-Run install:

reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport
"%ProgramFiles%\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user

Compare the reported version with the fixed build in the advisory.

2. Cut off the hash leak path

These steps are general NTLM hardening, not instructions from Microsoft's advisory. They limit the damage from any bug that makes Outlook connect to an attacker's server.

Block outbound SMB to the internet on endpoints:

New-NetFirewallRule -DisplayName "Block outbound SMB to internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action Block

Then add your perimeter firewall rule for TCP 445 if you do not already have one.

3. Look for signs of exposure

See which machines hold outbound SMB connections right now:

Get-NetTCPConnection -RemotePort 445 -State Established | Select-Object LocalAddress, RemoteAddress, OwningProcess

If you enable the policy "Network security: Restrict NTLM: Audit outgoing NTLM traffic to remote servers", you can review outgoing NTLM events:

Get-WinEvent -LogName "Microsoft-Windows-NTLM/Operational" -MaxEvents 200 | Where-Object Id -eq 8001

An outgoing NTLM attempt to an unknown external address is a red flag. Reset that user's password and review their sign-in activity.

Worked example

Imagine a finance clerk gets a message file from a "vendor" and double-clicks it. Outlook silently connects to a server the attacker controls, and the clerk sees no warning. The attacker captures the NTLMv2 hash.

If that connection uses SMB, the outbound SMB block stops the leak. Other paths, such as WebDAV over HTTP, would need separate controls. With the patch installed, Outlook should not skip the warning in the first place.

Other Patch Tuesday details

This month's updates are the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Those devices will not get further monthly security updates, so plan the move to a newer version.

Microsoft also republished 165 third-party CVEs and noted that Chrome vulnerabilities are not listed. October's release was bigger, at a record 1,413 vulnerabilities.

For more on this bug, see our CVE-2026-124194 patch guide. Another recent Microsoft issue is covered in our write-up on the Windows SignDrop zero-day.

What learners can take from this

This bug shows why identity security matters as much as malware defense. A moderate score still hid a real credential-theft path, and patch triage needs context beyond CVSS. Learners often practice exactly this thinking: reading advisories, ranking risk and hardening authentication.

If you want a structured path into this work, the AZ-500 Azure Security Engineer Associate voucher is a common next step for identity and platform protection. Vouchers arrive by email within 12 hours.

Sources

• Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (SecurityWeek)