Skip to content

Outlook zero-day CVE-2026-124194: November Patch Tuesday

Outlook Exchange Windows

Microsoft's November 2026 security updates, released on 10 November, fix one exploited zero-day: Outlook spoofing flaw CVE-2026-124194, which can leak a user's NTLMv2 hash. CISA added it to its Known Exploited Vulnerabilities catalog the same day with a due date of 24 November 2026, so every tenant with Outlook desktop should deploy the November Office update first.

Do this today

What: Outlook spoofing flaw CVE-2026-124194, "Exploited:Yes" per Microsoft and in CISA's KEV catalog since 10 November 2026.
Who is exposed: users of Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
The one action: deploy the November 2026 Office update and confirm the build on every device. CISA's due date: 24 November 2026.
For the Microsoft 365 side of the same estate, the M365 Hardening Kit has a free Top 10 with read-only checks.

Runbook card

What changes: a crafted file opened in Outlook can make it connect to an attacker's server without the usual external-content warning and disclose the user's NTLMv2 hash. Microsoft's fix is the November Office update.
Who: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit). Also on this release: Exchange Server Subscription Edition (CVE-2026-118207, Critical) and Windows.
By when: now. CISA due date for US federal agencies: 24 November 2026.
Do this: 1. Push the November Office update and check builds: Office LTSC 2021 16.0.14334.21048, Office LTSC 2024 16.0.17932.21140, Microsoft 365 Apps per Microsoft's security update list. 2. Install Exchange SE update KB5133453 (build 15.02.2562.057). 3. Confirm the November Windows cumulative update on servers, domain controllers first.
Check: the Office version on each device (command below) or your Intune or Microsoft 365 Apps admin center inventory.
Source: MSRC November 2026 Security Updates and the CISA KEV catalog (catalog version 2026.11.10).

What Microsoft and CISA say about CVE-2026-124194

Microsoft titles it "Microsoft Outlook Spoofing Vulnerability", severity "Moderate", CVSS 3.1 base score 6.5. Its status line reads "Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected". The CVSS temporal metric in the same entry says "E:U" (unproven), which conflicts with "Exploited:Yes"; we quote both and treat the flaw as exploited.

Microsoft's FAQ says an attacker "could send a specially crafted message file and convince a user to open it". Opening it "could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning". The flaw "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user". The Preview Pane is not an attack vector: the user has to open the file.

Microsoft credits "Benoît Sevens using Claude with Anthropic" and "nono" for the report. Microsoft names no attacker and no campaign, so neither do we.

CISA added CVE-2026-124194 on 10 November 2026 as "Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability", due 24 November 2026. Use in ransomware campaigns is listed as "Unknown".

Affected and fixed versions

Product Fixed build
Office LTSC 2021 (32-bit and 64-bit) 16.0.14334.21048
Office LTSC 2024 (32-bit and 64-bit) 16.0.17932.21140
Microsoft 365 Apps for Enterprise (32-bit and 64-bit) per channel, see Microsoft 365 Apps security updates

The rest of November's release

Microsoft's November 2026 update document lists 1,342 CVE entries, including third-party entries such as Chromium, so it is not a count of Microsoft-only bugs. 68 entries are rated Critical for at least one product. One is exploited (the Outlook flaw above) and none is marked publicly disclosed. Counts in press and tracker sites differ; these come from Microsoft's own document.

Critical items most admins run, all "Exploited:No":

  • Exchange Server Subscription Edition: CVE-2026-118207, remote code execution, CVSS 8.8, "Exploitation More Likely". Fix: KB5133453, build 15.02.2562.057. Exchange 2016 and 2019 get no update for it, as support has ended.
  • Windows: Active Directory Domain Services CVE-2026-118146 and Schannel CVE-2026-119952 (both "Exploitation More Likely"), TCP/IP CVE-2026-113859, SMB srvnet.sys CVE-2026-113825 and LDAP CVE-2026-119958. All are remote code execution.

How to check (read-only)

Office version on a Windows device (Click-to-Run installs):

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' |
  Select-Object VersionToReport, Platform

Or in Outlook: File > Office Account > About Outlook. Across the estate, use the Microsoft 365 Apps admin center inventory or Intune.

Exchange SE build, in the Exchange Management Shell on each server:

Get-Command ExSetup | ForEach-Object { $_.FileVersionInfo.ProductVersion }

How to verify the fix

The Office version is at or above the fixed build for its channel, and ExSetup on each Exchange SE server reads 15.02.2562.057 or later. Re-run the checks a day after deployment to catch devices that were offline.

Reduce the NTLM exposure

Our suggestion, not vendor guidance: the leak works because Outlook reaches out to an attacker's server. Blocking outbound SMB (TCP 445) to the internet at the firewall, adding admin accounts to the Protected Users group and auditing outgoing NTLM where you can reduce what a leaked hash is worth. Test NTLM restrictions in audit mode first, as older apps and file shares may still depend on NTLM.

Rollback and impact

Our suggestion, not vendor guidance: Office updates need Outlook restarted, so tell users and let the update deadline close the app outside working hours. Exchange updates restart services; patch one server at a time behind your load balancer.

Related: Exchange Server 2016 and 2019 end of updates, Windows Shell zero-day of October, the Threats & vulnerabilities roundup of 6 November, the deadlines guide and more Threats & vulnerabilities news.

Sources

Last reviewed: 10 November 2026. Runbook Lab is not affiliated with Microsoft. We have not tested these steps in a live tenant.