Microsoft has confirmed that attackers are actively exploiting a previously undisclosed Outlook vulnerability that can expose a victim’s Windows authentication hash the moment they open a specially crafted file. The flaw, tracked as CVE-2026-124194, was fixed as part of the November 2026 Patch Tuesday release and is flagged by Microsoft as “Exploitation Detected” — the company’s designation for vulnerabilities it has confirmed are already being used in real attacks, not merely theoretical risks.

A Moderate CVSS Score That Undersells the Urgency

On paper, the vulnerability’s numbers look unremarkable: a CVSS base score of 6.5 and a “Moderate” severity rating from Microsoft. That score reflects the technical mechanics of the flaw in isolation, but it doesn’t capture what matters most here — confirmed, in-the-wild exploitation. Microsoft’s own Exploitability Index draws a specific distinction between vulnerabilities attackers could plausibly weaponize and ones where the company has direct evidence of real attacks already underway. CVE-2026-124194 falls into the second, more urgent category, which is why it belongs near the top of any November patching queue regardless of its raw score.

How the Attack Works

The vulnerability requires no prior access to a victim’s account or system, but it does require a small amount of user interaction. An attacker sends a specially crafted message file and convinces the recipient to open it in an affected version of Outlook. Critically, Microsoft states explicitly that the Preview Pane is not a viable attack path here — simply previewing the message in Outlook’s reading pane does not trigger the flaw, which sets this bug apart from some earlier Outlook vulnerabilities that required nothing more than a glance.

Once the malicious file is opened, Outlook can be tricked into connecting to a network location the attacker controls, without displaying the external-content warning that would normally alert the user something unusual is happening. Microsoft classifies the root cause under CWE-356 — a case where an application’s interface fails to warn users about a potentially unsafe action, removing a safeguard that would otherwise give someone a chance to stop the connection before it happens.

That silent outbound connection is where the real damage occurs: according to Microsoft’s advisory, successful exploitation discloses the user’s NTLMv2 hash. In practical terms, this hands an attacker material that can potentially be used to authenticate as the victim, either through relay attacks against other services or offline cracking attempts, depending on how well-protected the receiving systems are. Microsoft rates the confidentiality impact as High, while noting there’s no direct impact on data integrity or system availability — this is a credential-theft bug, not a code-execution or destructive one.

What’s Affected and What to Patch

The vulnerability affects Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024, across both 32-bit and 64-bit builds. Fixed versions are available now: build 16.0.14334.21048 for Office LTSC 2021, and 16.0.17932.21140 for Office LTSC 2024. Organizations running Microsoft 365 Apps for Enterprise should install the applicable November 2026 security update corresponding to their deployed update channel, since Microsoft’s advisory does not list a single universal build number for that product line.

As a supplementary — not substitute — mitigation, Microsoft recommends blocking unnecessary outbound SMB traffic on TCP port 445 at the network perimeter. This can reduce the blast radius of any resulting NTLM relay attempts, but it does not address the underlying Outlook flaw and should not be treated as a replacement for applying the security update.

Recommended Actions

• Apply the November 2026 Outlook/Office security updates immediately given confirmed active exploitation
• Verify update status across all deployed channels of Microsoft 365 Apps for Enterprise, not just LTSC installations
• Block outbound SMB (TCP 445) traffic to the internet as a defense-in-depth measure
• Reinforce user awareness around opening unexpected message file attachments, even though this exploit doesn’t rely on the Preview Pane
• Monitor for anomalous outbound SMB authentication attempts that could indicate hash capture or relay activity

With Microsoft explicitly confirming real-world exploitation rather than just a theoretical risk, this is one Patch Tuesday fix that shouldn’t wait for a routine deployment cycle — particularly in environments where Outlook is widely used and SMB egress isn’t already restricted.