Exploited Outlook Zero-Day: CVE-2026-124194 Security Advisory

Microsoft has released critical updates for an actively exploited Outlook zero-day vulnerability, CVE-2026-124194. If your business uses Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024, you are directly affected and must apply these patches today to prevent the disclosure of user authentication information.

What Happened: An Actively Exploited Outlook Spoofing Flaw

Microsoft's November 2026 Patch Tuesday addressed a significant number of vulnerabilities across its product line, totaling 1,094 flaws. Among these was CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that Microsoft confirmed was actively exploited in the wild before the fix was publicly available.

This zero-day has been assigned a 'moderate' severity rating with a CVSS score of 6.5. The core issue stems from Outlook not displaying the usual external-content warning before connecting to an attacker-controlled network location when a user opens a specially crafted malicious file. This oversight can lead to the disclosure of a user's NTLMv2 hash, which an attacker could then use for impersonation.

CISA has categorized CVE-2026-124194 as an actively exploited vulnerability and added it to their Known Exploited Vulnerabilities catalog on 2026-11-10. US federal agencies are mandated to apply mitigations by 2026-11-24, highlighting the urgency of this patch. The vulnerability was discovered by researchers ‘nono’ and Benoît Sevens.

Are You Affected? Check Your Outlook Versions Immediately

This vulnerability specifically targets Microsoft Outlook installations within certain Office suites. An attacker needs to trick a victim into opening a malicious file; importantly, the flaw cannot be triggered simply by viewing the malicious content in the Preview Pane. Understanding your installed versions is the first step to determining your exposure.

To check if your organization is affected, identify the version of your Microsoft Office installation. This is typically done through any Office application (e.g., Outlook, Word) by navigating to 'File' > 'Account' > 'About Outlook' or similar. Compare your version number against the affected ranges.

The affected versions of Microsoft Outlook are:

Immediate Action: Patch Your Systems Today

Given that CVE-2026-124194 is actively exploited, immediate patching is non-negotiable for all affected systems. This is your primary defense against exploitation. Do not delay these updates.

For Microsoft 365 Apps for Enterprise, navigate to any Office application, go to 'File' > 'Account' > 'Update Options' > 'Update Now' or follow the instructions at aka.ms/OfficeSecurityReleases to ensure you are on the latest security release.

For Office LTSC 2021, ensure your installation is updated to version 16.0.14334.21048 or a later release. For Office LTSC 2024, update to version 16.0.17932.21140 or newer. Confirm these updates are applied across all relevant endpoints.

If, for any reason, immediate patching is not feasible across all devices, implement stringent email hygiene policies. Educate users about the risks of opening unexpected attachments, even from known senders. Consider sandboxing email attachments or implementing advanced threat protection for email. For comprehensive support with patch management and system security, explore VITI Security's managed IT services or cybersecurity solutions.

How to Spot Potential Exploitation

The primary impact of successful exploitation is the disclosure of a user's NTLMv2 hash. An attacker can then use this hash to authenticate as the user, potentially gaining unauthorized access to other network resources. Since the vulnerability requires opening a malicious file, monitoring user behavior and network activity is key.

Look for unusual outbound network connections originating from Outlook or other Office processes, especially to external or unknown IP addresses. Scrutinize authentication logs for suspicious NTLMv2 authentication attempts, particularly those that do not align with expected user activity or that originate from unusual locations or systems.

While Microsoft's advisory did not provide specific Indicators of Compromise (IOCs) for observed attacks, general signs of compromise related to this type of vulnerability include unauthorized access to internal resources, creation of new user accounts, or unusual data exfiltration. Implement robust endpoint detection and response (EDR) solutions and leverage 24x7 SOC monitoring to catch anomalies. Regular VAPT assessments can help identify weaknesses before they are exploited.

What This Means for Small and Mid-Size Businesses

For SMBs, this exploited Outlook vulnerability is a significant concern. Email remains a top vector for initial compromise, and the disclosure of NTLMv2 hashes can quickly escalate into broader network breaches, data theft, and ransomware attacks. SMBs in India and the US often operate with lean IT teams, making rapid response to zero-day exploits particularly challenging.

The direct implication is that a single user mistake-opening a malicious file-can lead to an attacker gaining a foothold to impersonate that user across your Windows domain. This could enable lateral movement, privilege escalation, and access to sensitive data, bypassing other security controls. The 'moderate' CVSS score should not detract from the critical impact of an actively exploited flaw.

Prioritize patching immediately. Beyond that, enhance your security posture with proactive measures. Implement mandatory security awareness training focusing on phishing and malicious attachments. Ensure your incident response plan is up-to-date and tested; if you lack an internal team, consider VITI Security's incident response services. Finally, consider a virtual CISO (vCISO) service to guide your security strategy and ensure ongoing compliance and risk management.

Sources