All security advisories
Security advisoryActively exploitedFix available
Actively Exploited Outlook Flaw: CVE-2026-124194
Published
Summary
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, after Microsoft confirmed active exploitation. Microsoft released fixes in its November 2026 Office security updates. U.S. federal civilian agencies must remediate by November 24, 2026.
How the attack works
- An attacker sends a crafted message file and persuades the user to open it.
- Outlook connects to an attacker-controlled network location without showing its usual external-content warning.
- Outlook leaks the user's NTLMv2 hash, which the attacker can use to authenticate as that user.
- Microsoft says the Preview Pane is not an attack vector.
- Microsoft rates it Moderate (CVSS 6.5). Weakness: CWE-356, product UI does not warn the user of unsafe actions.
Affected
Outlook for Windows in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
Recommended actions
- Deploy the November 2026 Office security updates and verify the installed build on each device.
- Confirm every Microsoft 365 Apps update channel has received the fix.
- Block outbound SMB (TCP 445) and NTLM traffic to the internet, after testing for dependencies such as internet-facing file shares.
- Warn users about unexpected message file attachments.
- Review sign-in activity for accounts that may have opened suspicious files, looking for behavior that does not fit the user.
Why it matters
A moderate score did not stop attackers from using this flaw. Prioritize by what is being exploited, not by severity score alone.