Microsoft Patches Outlook Zero-Day CVE-2026-124194 for NTLM Hash Theft
Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update
Related Entities
Products & Tech
Other
CVE Identifiers
Full Report
Executive Summary
Microsoft's November 2026 Patch Tuesday is one of the largest on record, addressing between 1,235 and 1,259 vulnerabilities across its product ecosystem. The most prominent fix addresses CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that is being actively exploited in the wild. This zero-day flaw, rated with a CVSS score of 6.5, allows an unauthenticated attacker to steal a user's NTLMv2 hash by convincing them to open a specially crafted .msg file. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, underscoring its urgency. Organizations are strongly advised to prioritize the deployment of this patch to prevent credential theft and subsequent network compromise.
Vulnerability Details
The vulnerability, CVE-2026-124194, is a moderate-severity spoofing flaw in Microsoft Outlook. It exists because Outlook fails to present the standard security warning when a user opens a malicious .msg file containing a path to a remote Server Message Block (SMB) share. An attacker can craft such a file and send it to a victim. When the victim opens the file, their system attempts to authenticate to the attacker-controlled SMB server, thereby leaking the user's NTLMv2 hash.
- Attack Vector: The attacker must send a specially crafted file to the user and convince them to open it. The vulnerability is not triggerable via the Preview Pane, requiring explicit user interaction.
- Prerequisites: An attacker needs to set up a network share (e.g., an SMB server) to capture the incoming authentication attempts.
- Impact: Successful exploitation results in the theft of the user's NTLMv2 hash. This hash can be used in pass-the-hash or relay attacks to authenticate to other services on the network as the compromised user, potentially leading to lateral movement and deeper network access.
Affected Systems
The vulnerability affects the following Microsoft products:
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2024
- Microsoft Office LTSC 2021
Exploitation Status
Microsoft has confirmed that CVE-2026-124194 has been actively exploited in the wild as a zero-day. However, details regarding the threat actors or the scale of the attacks have not been disclosed. Due to its active exploitation, CISA added it to the KEV catalog on November 10, 2026, with a remediation deadline of November 24, 2026, for federal agencies.
Impact Assessment
Despite its moderate CVSS score of 6.5, the real-world impact of this vulnerability is high. NTLM hash theft is a classic and effective technique for initial access and privilege escalation. Once an attacker obtains a valid hash, they can bypass traditional password-based authentication. This is particularly dangerous in environments that have not fully transitioned to stronger authentication protocols like Kerberos or have not implemented SMB signing and other hardening measures. The stolen credentials could grant access to email, file shares, and other sensitive corporate resources, making it a valuable tool for both commodity malware operators and sophisticated APT groups.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems: Security teams can hunt for potential exploitation attempts by monitoring for anomalous network traffic and endpoint behavior.
.msg file creation.msg files with subsequent outbound SMB traffic from the same host.Detection Methods
- SIEM/EDR: Create detection rules to alert on outbound SMB traffic (
TCP/445) from end-user workstations to IP addresses outside the corporate network. This is a high-fidelity indicator of potential NTLM relay or hash theft attempts. - Network Traffic Analysis: Use network monitoring tools to identify and alert on NTLM authentication attempts to external servers. D3FEND's
Network Traffic Analysiscan be instrumental here. - File Analysis: While difficult to inspect
.msgfiles at scale, security solutions can be configured to scrutinize files containing UNC paths pointing to external resources.
Remediation Steps
- Patch Immediately: The primary remediation is to apply the security updates released by Microsoft as part of the November 2026 Patch Tuesday. This is the most effective way to fix the vulnerability.
- Block Outbound SMB: Block
TCP/445outbound at the perimeter firewall. There are very few legitimate business reasons for client devices to initiate SMB connections to the internet. This is a critical compensating control that mitigates this and many other threats. - Harden NTLM: Enforce policies that restrict or disable the use of NTLM where possible. Enable Extended Protection for Authentication and SMB signing to mitigate NTLM relay attacks.
- User Education: Remind users to be cautious of opening unsolicited attachments, even if they appear to be standard document types like
.msgfiles.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying the security update from Microsoft is the primary and most effective mitigation.
Filter Network Traffic
Block outbound SMB traffic (TCP/445) at the network perimeter to prevent credentials from being sent to external attacker-controlled servers.
User Training
Train users to be suspicious of unexpected attachments, even from seemingly legitimate sources, to prevent them from opening malicious files.
Restrict or disable the use of NTLM authentication where possible in favor of stronger protocols like Kerberos.
D3FEND Defensive Countermeasures
Organizations must prioritize the deployment of the November 2026 security updates for all affected Microsoft Office and Microsoft 365 products. This patch directly addresses the root cause of CVE-2026-124194 by ensuring Outlook properly handles security warnings for external content. Patching should be managed through established systems like Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager (MECM), or Microsoft Intune. Given the active exploitation, a risk-based approach should be taken, prioritizing the patching of systems used by high-value targets such as executives, finance, and IT administrators. Verification of patch deployment is critical; use asset management and vulnerability scanning tools to confirm that all relevant endpoints have received and successfully installed the update. This action is the most direct and effective countermeasure against this specific threat.
As a critical compensating control, organizations must implement strict outbound traffic filtering at all network egress points. Specifically, create a default-deny rule for outbound SMB traffic on TCP port 445 and UDP ports 137/138. There are almost no legitimate use cases for internal client devices to initiate SMB connections to the public internet. This single change provides a powerful defense-in-depth layer that mitigates the core risk of CVE-2026-124194, which is the exfiltration of the NTLM hash to an attacker-controlled server. This rule should be enforced on perimeter firewalls, cloud network security groups, and host-based firewalls. While some exceptions may be required for specific business-to-business services, they should be tightly controlled with IP-based allow-lists. This countermeasure not only stops this attack but also disrupts many other malware families and data exfiltration techniques.
Timeline of Events
Microsoft releases its November 2026 Patch Tuesday, including a fix for CVE-2026-124194.
CISA adds CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.