The U.S. Cybersecurity and Infrastructure Security Agency has confirmed that the Microsoft Outlook zero-day vulnerability identified as CVE-2026-124194 is being actively exploited. This flaw allows attackers to steal user authentication data under specific conditions, raising serious concerns for affected organizations.
How the Vulnerability Works
An attacker exploits this Outlook vulnerability by sending a malicious message file and convincing the recipient to open it. Once opened, Outlook may reach out to an external network location that the attacker controls—**without displaying its typical warning about external content**. That network interaction can expose the victim’s NTLMv2 hash, a sensitive credential which can be misused to impersonate the user. Microsoft classifies this risk as spoofing with a serious impact on confidentiality, though without affecting data integrity or service availability. The flaw aligns with CWE-356, which concerns bypassing user consent for potentially unsafe actions.
Scope, Fixes, and Response Timeline
This is not a zero-click flaw: a user interaction—specifically, opening a crafted file—is required. The Outlook Preview Pane is not involved, which separates this vulnerability from certain previous ones. Microsoft services including Microsoft 365 Apps for Enterprise, Office LTSC 2021, and LTSC 2024—both 32- and 64-bit—are in scope.
Microsoft has released fixed builds: 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Administrators are urged to apply these updates and verify installed build numbers rather than relying solely on update reports to ensure they are protected.
Official Alerts and Deadlines
On November 10, 2026, CISA added this flaw to its Known Exploited Vulnerabilities (KEV) catalog and imposed a remediation deadline of November 24, 2026. Organizations must apply patching or vendor mitigations, assess internet exposure, and discontinue affected products if no fix is available. Despite confirmed exploitation, details on the threat actor, victim count, or operational scale remain unclear.
Microsoft rates this vulnerability with a CVSS score of 6.5. While labelled as moderate severity, that rating should not downplay the real-world exploitation risks. Security teams are advised to prioritize this patch alongside other threats with similar assurance levels.
### What to Do Now
- Inventory all instances of Outlook in your environment tied to Microsoft 365 Apps for Enterprise and LTSC 2021/2024.
- Deploy security updates immediately and confirm through build versions.
- Monitor for any outbound connections that match suspicious external network reach-outs, especially those triggered by user-opened files.
- Review exposure of systems to internet access where this vulnerability might be exploited.
This kind of spoofing vulnerability in a major email client is a reminder that even non-code-execution flaws can have serious consequences. For organizations large and small, keeping patches current is one of the simplest but most crucial defenses.
