CVE-2026-124194: Outlook Zero-Day Leaks NTLM Hashes, and Patching Outlook Isn't Patching Windows

CVE-2026-124194 is an actively exploited Outlook zero-day, patched in Microsoft's November 2026 Patch Tuesday, that forces Outlook into leaking a user's NetNTLMv2 hash through a forced-authentication trick to an attacker-controlled server. The fix ships as an Office update, so confirming Windows is patched does not confirm this hole is closed.

Key takeaways

• CVE-2026-124194 is a zero-day in Microsoft Outlook that triggers forced NTLM authentication to an attacker's server, leaking a NetNTLMv2 hash that can be cracked or relayed.
• It was exploited in the wild before the patch landed, flagged as the one actively exploited flaw in SOCRadar's November 2026 Patch Tuesday roundup.
• The fix is an Office update, not a Windows OS patch, meaning WSUS or Windows Update compliance dashboards will not show you whether the exposure is actually closed, per the Windows Forum megathread.
• Patching stops future leaks. It does not tell you whether a hash already walked out the door, which is a monitoring and hunting problem, not a patch management problem.

What Is CVE-2026-124194?

CVE-2026-124194 is tracked by cvereports.com as a forced-authentication vulnerability in Microsoft Office Outlook that results in NetNTLMv2 credential leakage. In plain terms, a specially crafted item processed by Outlook causes the Windows host to automatically reach out and authenticate to a server the attacker controls, handing over a hashed version of the user's credentials without any click required.

Microsoft shipped the fix as part of its November 2026 Patch Tuesday, and SOCRadar's coverage names it the single exploited zero-day in that release. CSOonline separately confirms the Outlook flaw allows theft of hashed credentials and sat alongside 63 fixes Microsoft rated critical that month. Every organization running Outlook on Windows, managed or unmanaged, is a candidate for exposure until the Office-side update is confirmed installed.

How Does Outlook Leak an NTLM Hash?

This is a forced-authentication attack, meaning the victim's machine initiates the connection, the attacker never has to phish a click. Outlook processes a message or item referencing a remote resource, Windows interprets that as a reason to authenticate, and it sends an NTLM handshake to whatever server the attacker named. The server captures the NetNTLMv2 response and walks away with material it can crack offline or relay onward.

This pattern is not new, it is the same family of attack behind the long-running resurgence of NTLM relay attacks that SpecterOps documented. What makes CVE-2026-124194 notable is that Outlook, a mail client sitting on nearly every endpoint, is the trigger, and it was being exploited before a fix existed.

Why Patching Outlook Isn't the Same as Patching Windows

The fix for CVE-2026-124194 is delivered through an Office update, confirmed by the Windows Forum Patch Tuesday megathread, which titled its coverage around the requirement for an Office update specifically, not a Windows OS patch. gblock.app's writeup confirms the same scope.

That distinction matters operationally. Most MSPs track OS patch compliance through RMM and WSUS reporting, while Microsoft 365 Apps updates often run on a separate Click-to-Run servicing channel with its own cadence and its own reporting. An endpoint can show green across every Windows Update metric while Outlook itself is still on a vulnerable build. Treating "Windows is patched" as proof that Outlook is patched is exactly the gap this CVE exploits.

How Big Is November 2026 Patch Tuesday, Really?

It depends who you ask, and that is itself worth knowing. SOCRadar puts the release at 1,094 flaws. Rootshell Security counts 1,259. Infosecurity Magazine reports 1,235 and calls it a record. Different trackers, different scoping rules, different totals, same month.

The exact tally is less important than what every single one of these sources agrees on: CVE-2026-124194 was the exploited one. When you have over a thousand fixes landing in a single release, the triage question is never "did we patch everything," it is "did we patch the one that was already being used against us." For deeper background on why patch volume alone is a poor proxy for risk, see our analysis of September 2026's 974-CVE Patch Tuesday.

What Should MSPs Do This Week?

First, confirm the Office-side update, not just the Windows Update status, is applied across every endpoint running Outlook, including machines on delayed Click-to-Run channels. Decryption Digest's advisory and smtpedia's coverage both frame this as patch now, no exceptions.

Second, reduce NTLM's attack surface structurally rather than relying on patch cadence alone. Microsoft has been moving toward disabling NTLM by default in Windows, and its own Active Directory hardening guidance covers blocking outbound SMB at the perimeter and restricting NTLM authentication where it is not needed.