Threat watch / Vulnerability
Outlook: Microsoft patches a zero-day that leaks Windows login hashes through a crafted message file
On November 10, 2026, Microsoft's Patch Tuesday fixed CVE-2026-124194, an Outlook spoofing flaw that attackers are already exploiting. A crafted message file, once opened, makes Outlook connect to an attacker's server without the usual external-content warning, which can disclose the user's authentication information. Microsoft confirms attacks but has not said who is behind them or who was targeted. CISA added the flaw to its Known Exploited Vulnerabilities catalog.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Microsoft Outlook, Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024
- How it happened
- An unauthenticated attacker sends a specially crafted message file and convinces the user to open it in Outlook. Outlook then connects to an attacker-controlled network location without showing the external-content warning, and this connection can expose the user's NTLMv2 authentication hash, which could be used to impersonate them. The Preview Pane is not an attack vector.[1][2] Checked 10 Nov 2026
- What was stolen
- Not public yet Checked 10 Nov 2026
- Who was impacted
- Not public yet Checked 10 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-124194
Timeline
- Microsoft fixes CVE-2026-124194 in its November Patch Tuesday and says it has been exploited. Cyber Security News reports a CVSS score of 6.5 (Moderate) and affected versions Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise. Microsoft does not name the attackers, the victims or the scale of the attacks. [1][2]
- According to The Record, Microsoft credits Benoît Sevens with finding the flaw using Anthropic's Claude, and CISA adds it to its Known Exploited Vulnerabilities catalog. [1]