Outlook Zero-Day CVE-2026-124194: November 2026 Patch Tuesday Leaks NTLM Hashes

Microsoft's November 2026 security release, published on Tuesday, November 10, fixes 1,094 Microsoft CVEs and one of them is already being used in attacks. CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability that leaks the user's NTLMv2 password hash to an attacker. CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave US federal agencies until November 24 to patch.

What happened

According to Microsoft's advisory, an unauthenticated attacker can send a specially crafted message file and convince a user to open it in Outlook. Opening it makes Outlook connect to an attacker-controlled network location without displaying the usual external-content warning. Windows then tries to authenticate to that location, and the attacker captures the user's NTLMv2 hash, which Microsoft says can be used to authenticate as the user. In practice that means NTLM relay against services that still accept NTLM, or offline cracking of weak passwords.

Microsoft rates the flaw Moderate with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/C:H), classifies it as CWE-356 (the UI does not warn of an unsafe action) and marks it "Exploitation Detected". It was not publicly disclosed before the fix, and the advisory gives no details about the attacks. The acknowledgments credit a researcher called nono and Benoit Sevens, the latter "using Claude".

Two details matter for triage. First, the Preview Pane is not an attack vector: Microsoft says the user has to open the file. Second, the score understates the business risk. A leaked hash from a privileged user can be enough to start lateral movement. It is the same bug class as CVE-2023-23397, the 2023 Outlook NTLM leak for which Microsoft published dedicated investigation guidance.

Who is affected

Microsoft lists three products, each in 32-bit and 64-bit editions:

• Microsoft 365 Apps for Enterprise: the fixed build depends on your update channel; check Microsoft's Microsoft 365 Apps security updates page.
• Office LTSC 2021: fixed in build 16.0.14334.21048.
• Office LTSC 2024: fixed in build 16.0.17932.21140.

Where the mailbox is hosted does not matter. The bug is in the Outlook desktop client, so Exchange Online, Exchange Server and other mail backends are all in scope as long as users run an affected Outlook build.

The rest of November's release

The MSRC release notes list 1,094 Microsoft CVEs (726 in Windows, 174 in Office, 59 in SQL Server, 27 in SharePoint Server, 20 in Azure, 9 in Exchange Server) plus 165 republished non-Microsoft CVEs. That is why the totals in the news differ: Tenable counts 1,093 and BleepingComputer 1,235, depending on whether Edge and third-party entries are included. Only the Outlook flaw is marked as exploited. The critical items worth scheduling this week:

• CVE-2026-119958, Windows LDAP RCE (9.8, Critical): unauthenticated code execution through crafted LDAP calls. Patch domain controllers first.
• CVE-2026-116928, Windows Search RCE (9.8, Critical): Microsoft says an attacker can exploit the Windows Search component used by Exchange Server by emailing a crafted attachment, because Exchange indexes attachments automatically. Nobody has to open the email, so patch Windows on your Exchange servers quickly.
• CVE-2026-118207, Exchange Server RCE (8.8, Critical): needs an authenticated low-privilege attacker, rated "Exploitation More Likely". It affects Exchange Server Subscription Edition.
• CVE-2026-118146, Active Directory Domain Services RCE (8.8, Critical): authenticated, network reachable, also "Exploitation More Likely".
• CVE-2026-120002, SharePoint Server elevation of privilege (9.9): despite the score, Microsoft rates it Important. It abuses Secure Store credentials to act on connected business services.

Azure OpenAI also has a Critical entry, CVE-2026-119990 (elevation of privilege, 9.8), but Microsoft says it is already mitigated in the service and customers have nothing to do. SecurityWeek also notes this is the last monthly update for Windows 11 23H2 Enterprise and Education.

What to do now

1. Patch Outlook and confirm the build

Let Click-to-Run update, or force it, then read the installed version on a sample of machines:

# Force a Microsoft 365 Apps / Office LTSC update now
& "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user

# Installed version and channel
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' |
  Select-Object VersionToReport, CDNBaseUrl

Compare VersionToReport with the fixed builds above. In Intune or Configuration Manager, report on the same value across the fleet rather than trusting deployment status alone.

2. Reduce what a leaked NTLM hash is worth

Microsoft lists no workaround for this CVE, but the hardening it published for the 2023 Outlook NTLM flaw applies to the whole bug class:

• Block outbound TCP 445 to the internet at the perimeter firewall, on the host firewall and in VPN split-tunnel settings, so laptops off the corporate network are covered too.
• Put administrators and other high-value accounts in the Protected Users group, which stops NTLM authentication for its members. Test first: it breaks apps that need NTLM, and it is not meant for service or computer accounts.
• On Windows 11 24H2 and Windows Server 2025, the SMB client can refuse NTLM entirely with Set-SmbClientConfiguration -BlockNTLM $true (Microsoft Learn), with an exception list for legacy file servers.

3. Hunt for the outbound connection

If you use Microsoft Defender for Endpoint, this advanced hunting query finds Outlook talking SMB to public addresses, the network signature of this attack class. Tuning KQL like this is core SC-200 material:

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort == 445 and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl

Any hit deserves a password reset for that user and a look at their recent sign-ins. Identity-side follow-up, such as Conditional Access and risk policies for affected accounts, is covered in the SC-300 course. For broader detection work, see our threat hunting guide for Microsoft Sentinel.

Frequently Asked Questions

Can CVE-2026-124194 be triggered from the Outlook preview pane?

No. Microsoft's advisory says the Preview Pane is not an attack vector. The user has to open a crafted message file, which makes Outlook connect to an attacker-controlled network location without showing the usual external-content warning.

Which Outlook versions need the November 2026 update?

Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in 32-bit and 64-bit editions. The fixed LTSC builds are 16.0.14334.21048 for 2021 and 16.0.17932.21140 for 2024. Microsoft 365 Apps builds depend on your update channel.

Does blocking outbound SMB stop the NTLM hash leak?

It removes the most common path, Windows sending NTLM authentication over TCP 445 to a server on the internet, and it matches the guidance Microsoft gave for the 2023 Outlook flaw CVE-2023-23397. It does not replace the patch: install the update first and keep the block as defense in depth.

How many vulnerabilities did Microsoft fix in November 2026?

Microsoft's release notes list 1,094 Microsoft CVEs, plus 165 republished non-Microsoft CVEs. News outlets report 1,093 or 1,235 because they count Edge and third-party entries differently. One of them, the Outlook flaw CVE-2026-124194, was exploited as a zero-day.

Sources

• Microsoft Security Update Guide: CVE-2026-124194
• Microsoft: November 2026 Security Updates release notes
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-124194
• Microsoft Security Blog: guidance for CVE-2023-23397 (NTLM hardening)
• Microsoft Learn: Block NTLM connections on SMB
• Tenable: Microsoft November 2026 Patch Tuesday
• SecurityWeek: Exploited Outlook zero-day among 1,094 flaws patched