CVE-2026-124194: Actively Exploited Outlook Zero-Day Leaks NTLM Hashes -- Patch Office, Not Just Windows
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook rated CVSS 6.5, is under active in-the-wild exploitation as of November 10, 2026. Attackers deliver a specially crafted file; when a victim opens it in Outlook, the application initiates an outbound connection to the attacker's server and transmits the user's NTLMv2 credential hash -- with no external-content warning displayed. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, the same day Microsoft patched it as part of a record-breaking 1,235-CVE November 2026 Patch Tuesday release.
The critical operational detail: CVE-2026-124194 is not fixed by Windows Update. The patch ships through Microsoft Office's own Click-to-Run update channel. Organizations relying solely on Windows Server Update Services or automated OS patching will remain fully exposed after November's Windows Update cycle completes. Every Outlook desktop that hasn't had its Office suite updated independently is still vulnerable.
A stolen NTLMv2 hash is not a minor disclosure. Attackers who capture an NTLMv2 hash can relay it in real time to authenticate to any internal service that still accepts NTLM -- SMB file shares, Exchange Web Services, SharePoint, SQL Server, IIS-hosted applications. They can also crack the hash offline using GPU-accelerated tools, recovering plaintext passwords for accounts where password complexity allows it. The practical blast radius of a single Outlook user opening one file extends to every NTLM-accepting service that user can reach on the internal network.
Federal agencies have until November 24, 2026 to patch. Enterprise defenders should act before that deadline. This post covers how the exploit works, which Outlook builds are vulnerable, what to block at the perimeter right now while patches deploy, and how to detect exploitation attempts in your SIEM.
How Does CVE-2026-124194 Work?
CVE-2026-124194 exploits Outlook's handling of external file references in specially crafted message files. When a victim opens the crafted file, Outlook processes an embedded reference that resolves to an attacker-controlled network path -- most likely a UNC path pointing to the attacker's SMB server or a WebDAV endpoint over HTTP. Outlook initiates that connection automatically, without displaying the standard external-content warning dialog that normally appears before Outlook connects to remote resources.
The connection attempt triggers Windows' built-in authentication behavior: when Windows tries to authenticate to an SMB server, it first offers NTLM credentials. The attacker's server accepts the authentication exchange and captures the NTLMv2 hash -- the hashed form of the user's password combined with a server-sent challenge. The attacker never needs to know the user's password in advance; Outlook and Windows do the credential handoff automatically.
Critically, the Preview Pane does not trigger CVE-2026-124194. The victim must open the file -- not just preview it. This is an important containment detail for incident responders assessing exposure, but it does not substantially lower the risk in environments where users regularly open email attachments.
The vulnerability is classified as CWE-356 (Product UI Does Not Warn User Before Undertaking Risky Actions). The flaw is not in the NTLM protocol itself but in Outlook's failure to warn the user before initiating the outbound connection that hands NTLM credentials to an external host. Prior NTLM hash disclosure CVEs in Outlook -- including CVE-2026-32202 in the Windows Shell used by APT28 -- followed a similar pattern of suppressed UI warnings enabling covert credential handoff.
Which Microsoft Office Versions Are Affected?
CVE-2026-124194 affects the Outlook desktop application across multiple Microsoft 365 and volume-licensed Office editions. The November 2026 Patch Tuesday release includes fixes for all affected builds.
| Product | Architecture | Fixed Build | Action |
|---|---|---|---|
| Microsoft 365 Apps for Enterprise | 32-bit | November 2026 update | Apply Office update immediately |
| Microsoft 365 Apps for Enterprise | 64-bit | November 2026 update | Apply Office update immediately |
| Office LTSC 2024 | 32-bit and 64-bit | 16.0.17932.21140 | Apply Office update immediately |
| Office LTSC 2021 | 32-bit and 64-bit | 16.0.14334.21048 | Apply Office update immediately |
Microsoft 365 Apps for Business and Home subscriptions receive updates through the standard Microsoft 365 update mechanism and are covered by the same November 2026 release. Outlook on the web (OWA), Outlook for iOS, and Outlook for Android are not listed as affected in the MSRC advisory.
The update does not ship through Windows Update. Organizations must trigger Office Click-to-Run updates separately -- via Microsoft Endpoint Manager, WSUS for Office, Intune, or manual update through Outlook's File > Office Account > Update Options > Update Now. Any endpoint where Windows Update ran but Office was not updated remains fully exposed.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Why Is a 'Moderate' CVSS 6.5 Flaw Under Active Exploitation?
Microsoft's CVSS 6.5 rating reflects the interaction required -- a user must open a crafted file -- and the fact that CVE-2026-124194 alone does not give an attacker remote code execution or direct system access. The rating does not account for what a stolen NTLMv2 hash enables in a real network environment.
NTLMv2 relay chains are the reason this "moderate" flaw is CISA KEV-listed and actively exploited. An attacker who captures an NTLMv2 hash can:
- Relay the hash in real time to authenticate to any service that accepts NTLM on the internal network -- SMB shares, Exchange Web Services, SharePoint, internal IIS sites, SQL Server. The attacker impersonates the victim account without ever cracking the password.
- Crack the hash offline using GPU-accelerated tools. An 8-character password with standard complexity falls in under 15 minutes on modern hardware. Longer passwords require more time, but the hash can be retained indefinitely for future cracking.
- Escalate privileges if the relayed hash belongs to a service account, administrator, or machine account, using techniques including Silver Ticket attacks, ADCS certificate requests (ESC1-ESC8), and resource-based constrained delegation abuse.
The historical precedent is clear. CVE-2023-23397, a prior Outlook NTLM hash disclosure that triggered automatically in the Preview Pane without any user interaction, was exploited by APT28 to compromise government, military, energy, and transportation organizations across Europe before it was patched. CVE-2026-124194 requires the user to open the file rather than preview it, which is a marginally higher bar -- but CISA's same-day KEV listing confirms active exploitation is already occurring.
“An attacker who successfully exploits this vulnerability could coerce the client to authenticate to an attacker-controlled server and potentially use that to perform an NTLM relay attack.”
Microsoft Security Response Center, CVE-2026-124194 Advisory, November 10, 2026
Indicators of Compromise for CVE-2026-124194 Exploitation
No specific attacker C2 infrastructure has been publicly released for the CVE-2026-124194 exploitation campaign as of November 11, 2026. The following behavioral indicators are derived from the CVE mechanics and are reliable detection artifacts for this class of NTLM hash disclosure attack. Validate against your environment before deploying automatic blocking.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sigma Detection Rules for CVE-2026-124194 NTLM Hash Theft
Two detection rules cover the initial hash disclosure behavior and the Windows authentication event associated with NTLM hash transmission. Both carry experimental status; validate against your endpoint telemetry and SIEM field mappings before enabling automatic alerting.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock Sigma Hunt Queries
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock WAF Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
How to Patch CVE-2026-124194 and Block NTLM Relay Attacks
Apply the November 2026 Office update first. Then layer the network and configuration mitigations below to block relay attacks even if unpatched endpoints remain in your environment. Work through these steps in priority order.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
If You're Already Compromised
These steps are for defenders who suspect active exploitation has occurred -- for example, any OUTLOOK.EXE external TCP 445 connection found in logs, an NTLM relay alert from a security tool, or a credential abuse report from a downstream system. Act in this order.
Subscribe to unlock Incident Response guidance
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Why CVE-2026-124194 Matters for Your Organization
The word "Moderate" on CVE-2026-124194's CVSS label is the most dangerous thing about this vulnerability. Organizations that triage patches by severity will deprioritize it behind Critical and High CVEs -- and their automated OS patching pipelines will silently miss it because it ships in the Office update channel, not Windows Update.
An NTLM hash stolen via CVE-2026-124194 is a skeleton key for every service on your internal network that still accepts NTLM authentication. That includes file shares, Exchange, SharePoint, internal web applications, SQL Server, remote access tooling, and any application relying on Windows Integrated Authentication. A single employee opening a crafted email attachment before the Office update deploys is enough exposure.
The pattern of Outlook NTLM hash disclosure vulnerabilities being actively exploited before patches reach most endpoints is well established. CVE-2023-23397 -- the predecessor that required only the Preview Pane to trigger -- was used by APT28 against NATO member government and military organizations for nearly a year before its public disclosure in March 2023. CISA's decision to KEV-list CVE-2026-124194 on the same day as its patch indicates that exploitation is already underway, not theoretical.
The organizations most exposed are those where:
- Office Click-to-Run updates are not managed or monitored centrally
- Outbound SMB (TCP 445) is not blocked at the perimeter
- NTLM is still the dominant authentication protocol because Kerberos migration has been deferred
- Privileged accounts are not in the Protected Users group
If your organization fits two or more of these categories, treat this as a 24-hour remediation priority, not a standard Patch Tuesday item.
The bottom line
CVE-2026-124194 Outlook NTLM hash theft is under active exploitation right now, and Windows Update alone will not fix it -- the November 2026 Office update must be applied separately. Block outbound TCP 445 at the perimeter immediately as a bridging control, then push the Office update across all endpoints. Enforce SMB signing, LDAP signing, and EPA on internal services to block relay attacks even if hashes are captured. Add privileged accounts to Protected Users. CISA's November 24 federal deadline is a floor, not a target -- enterprise environments should aim to close this gap within 48 hours.
This analysis is generic. create a free account to score threats like this against your own stack.
Frequently asked questions
What is CVE-2026-124194?
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that causes the application to open a covert outbound connection to an attacker-controlled server when a user opens a specially crafted file. Windows automatically sends the user's NTLMv2 credential hash as part of the authentication attempt, handing the attacker a reusable credential token without displaying any warning. CISA added it to the Known Exploited Vulnerabilities catalog on November 10, 2026.
How does the Outlook NTLM hash theft exploit work?
An attacker embeds a UNC path or external resource reference in a crafted .msg or .oft file. When the victim opens the file in Outlook, the application resolves the reference and initiates an outbound connection to the attacker's server -- typically an SMB server on TCP 445. Windows' built-in authentication mechanism sends the user's NTLMv2 hash as part of the connection setup. The attacker captures the hash without supplying any credentials and without triggering Outlook's standard external-content warning.
Does CVE-2026-124194 require the user to open an attachment?
Yes. The vulnerability requires the victim to open the crafted file in Outlook. The Preview Pane does not trigger CVE-2026-124194. This means that email hygiene practices -- specifically, not opening unexpected attachments or files from unknown senders -- reduce exposure. However, attackers can embed the crafted object inside seemingly legitimate business documents, so user training alone is not a reliable control.
Why won't Windows Update fix CVE-2026-124194?
CVE-2026-124194 is patched in Microsoft Office, not in the Windows operating system. Office Click-to-Run and volume-licensed Office products ship updates through a separate channel from Windows cumulative updates. Organizations that manage patching through WSUS for the OS but do not separately manage Office updates will complete November's Windows Update cycle and remain fully exposed. The fix must be applied through Outlook's File > Office Account > Update Options > Update Now, Microsoft Endpoint Configuration Manager's Office update channel, or Intune's Office 365 app update policies.
What can an attacker do with a stolen NTLMv2 hash?
A stolen NTLMv2 hash enables two attack paths. First, real-time relay: the attacker passes the hash to a relay tool that authenticates to other internal services -- SMB shares, Exchange Web Services, SharePoint, IIS sites, SQL Server -- on behalf of the victim without cracking the password. Second, offline cracking: the attacker uses GPU-accelerated tools to recover the plaintext password from the hash, gaining credentials valid for VPN, cloud services, and anywhere the victim reuses the password.
What is an NTLM relay attack?
An NTLM relay attack intercepts an NTLMv2 authentication exchange and forwards it in real time to a third service. The relay tool sits between the victim and the attacker's server, capturing the authentication tokens and immediately replaying them to authenticate to a different target -- for example, an internal file server or Exchange OWA. The attacker never needs to know the user's password. The relay is blocked when SMB signing, LDAP signing, and Extended Protection for Authentication (EPA) are enforced on target services.
How do I detect NTLM hash theft in my environment?
Monitor for OUTLOOK.EXE initiating outbound network connections to TCP 445 on external (non-RFC1918) IP addresses using Sysmon Event ID 3 or EDR network telemetry. Also watch Windows Security Event ID 4624 with LogonType 3 and AuthenticationPackageName NtLmSsp where the process is OUTLOOK.EXE. Any SMB connection from Outlook to an internet IP is anomalous and should trigger immediate investigation. The Sigma and SIEM detection rules in this post cover both behaviors.
Which organizations are most at risk from CVE-2026-124194?
Organizations most at risk are those with unmanaged or manually triggered Office update pipelines (where Windows Update completes but Office is missed), those that have not blocked outbound TCP 445 at the perimeter, and those where NTLM remains the primary authentication protocol because Kerberos migration has been deferred. High-value targets -- government, defense, financial services, legal, healthcare -- are historically the most likely to face Outlook NTLM hash theft campaigns given the value of their internal communications and the sensitivity of credentials on those networks.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.