Outlook Zero-Day CVE-2026-124194: What It Is and How to Fix It

Short answer: CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that attackers were already using before Microsoft fixed it on Patch Tuesday, November 10, 2026. If you open a specially crafted message file, Outlook connects to a server the attacker controls without showing its usual warning, and Windows sends your NTLMv2 password hash to that server. The fix is the November 2026 Office update: in Outlook, go to File > Office Account > Update Options > Update Now. Then block outbound SMB (TCP 445) at your firewall and put admin accounts in the Protected Users group.

What happened

On November 10, 2026, Microsoft released its monthly security updates. One of the fixes was for CVE-2026-124194 in Outlook, and Microsoft marked it as already exploited. That is what “zero-day” means: attackers found and used the bug before a fix existed.

Fact	Detail
CVE	CVE-2026-124194
Product	Microsoft Outlook (part of Microsoft Office)
Type	Spoofing
CVSS score	6.5
Status	Exploited in the wild, fixed on November 10, 2026
CISA	Added to the Known Exploited Vulnerabilities catalog, with a November 24, 2026 deadline for US federal agencies

The CISA listing matters even if you don’t work for a government. CISA only adds a bug to that catalog when there is reliable evidence of real attacks, so it’s a good signal for what to patch first.

How the attack works

The attack has four steps:

1. The attacker emails you a specially crafted message file.
2. You open the file in Outlook.
3. Outlook quietly connects to a network location the attacker controls. Normally Outlook warns you before it loads outside content. This bug skips that warning, which is why Microsoft classifies it as spoofing.
4. Because Windows signs in automatically when it connects to a network share, it sends your NTLMv2 hash to the attacker’s server.

An NTLMv2 hash is not your password, but it is derived from it. Think of it as a fingerprint of your password that Windows uses to prove who you are.

One piece of good news: according to the reports, just previewing the email in the Preview Pane is not enough. The victim has to open the file. So this is not a “zero-click” attack, even though some headlines call it that.

Why a 6.5 score is still serious

A CVSS score of 6.5 is “medium”, and the bug doesn’t let anyone run code on your PC. So why the urgency? Because a stolen hash gives an attacker two options:

• Crack it offline. The attacker can try billions of guesses against the hash on their own hardware. If your password is weak or reused, they recover it in plain text.
• Relay it. The attacker can pass the hash along to another service in real time and sign in as you, without ever knowing the password.

In a company network, that one user’s sign-in is often the first step toward file servers, mailboxes and eventually the whole domain. My opinion after years of supporting Windows networks: don’t sort your patching by score alone. “Medium and exploited” beats “critical and theoretical” every time.

Who is affected

According to the coverage of Microsoft’s advisory, the affected products are:

• Microsoft 365 Apps for Enterprise
• Office LTSC 2021
• Office LTSC 2024

If you run classic Outlook from any of these, install the November 2026 update. Check your exact version against Microsoft’s Security Update Guide, because I could not open that page from my research setup.

What to do today

1. Update Office

On one PC:

1. Open Outlook.
2. Click File > Office Account.
3. Click Update Options > Update Now.
4. Restart Outlook when the update finishes.

If you manage many machines, push the November 2026 Office update with your normal tool (Intune, Configuration Manager, WSUS or the Microsoft 365 Apps admin center) and check the compliance report afterwards.

2. Don’t open unexpected message files

Tell your users: if a .msg attachment arrives that they didn’t expect, they should not open it, even when the sender looks familiar. Attackers often send from a mailbox they already compromised.

3. Block outbound SMB (TCP 445)

Hash-leak attacks like this need your PC to reach the attacker’s server, usually over SMB. Block outbound TCP port 445 to the internet at your perimeter firewall, and on the Windows firewall of laptops that leave the office. There is almost never a good reason for a workstation to speak SMB to the internet.

4. Put admin accounts in Protected Users

Members of the Protected Users group in Active Directory can’t authenticate with NTLM at all, so there is no NTLM hash to steal.

Add-ADGroupMember "Protected Users" -Members abd.admin
Get-ADGroupMember "Protected Users"

Start with domain admins and other high-value accounts.

Steps 3 and 4 are general NTLM hardening. They are not an official Microsoft workaround for this CVE, but they limit the damage from this bug and the next one like it.

Errors and fixes

• “Update Options” is missing in Outlook. Your Office is managed by your organization or installed from the Microsoft Store. Ask your admin, or update from the Microsoft Store app under Library.
• “You’re up to date” but you’re not sure the fix is there. Go to File > Office Account > About Outlook, note the version and build, and compare it with the November 10, 2026 entry in Microsoft’s update history.
• An app stopped working after adding a user to Protected Users. That app still needs NTLM, or Kerberos delegation, or a long ticket lifetime. Remove the account from the group, fix the app, then try again. Never add service accounts without testing.
• Blocking port 445 broke a file share. You blocked internal traffic by mistake. The rule should only stop SMB going to the internet, not to your own file servers.

FAQ

Is CVE-2026-124194 a zero-click vulnerability?
No. Based on the reports, the victim has to open the crafted file. Viewing the email in the Preview Pane is not reported as an attack path.

Does this affect Outlook on the web or the new Outlook app?
The affected list covers the desktop Office products: Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Check Microsoft’s advisory for your exact product.

Should I change my password?
If you opened a suspicious message file before patching, yes. Change it, and make it long and unique so an offline crack is not practical.

Who is behind the attacks?
Microsoft has not published details about the attackers or indicators of compromise.

Is multi-factor authentication enough to stop this?
MFA helps for cloud sign-ins, but NTLM relay inside a network usually doesn’t trigger an MFA prompt. Patch, and reduce NTLM where you can.

Keep learning

• Active Directory tutorial for beginners
• Fake ChatGPT ClickFix trap: how one paste gets you hacked
• Find and remove a keylogger on Windows

Sources: Microsoft Security Update Guide entry for CVE-2026-124194, the CISA Known Exploited Vulnerabilities catalog, and coverage by SecurityWeek, Qualys, TechRepublic, SOC Prime and SecurityOnline, November 10 to 12, 2026.