Exploited Outlook flaw silently leaks NTLM hashes

CVE-2026-124194 is a Moderate-rated Outlook flaw, CVSS 6.5, that Microsoft has flagged as actively exploited. An unauthenticated attacker sends a specially crafted message file. When the target opens it in an affected version of Outlook, the client reaches out to an attacker-controlled network location without showing the external-content warning it would normally display, and that connection can disclose the user’s NTLMv2 hash.

It shipped as part of a Patch Tuesday of 1,259 CVEs, the second month running above a thousand. Microsoft counts 726 flaws in Windows, 174 in Office, and 27 in SharePoint Server, with more than 500 across the whole set rated elevation of privilege. Tenable’s Satnam Narang puts Microsoft’s 2026 total past 5,100 CVEs. Of all of them, this is the one to pull out of the queue first, because Microsoft has flagged it as actively exploited.

The underlying primitive is a forced-authentication leak, which is old. When an Outlook client follows a reference to a remote resource, it authenticates to that endpoint, and against an SMB or HTTP server the attacker controls, Windows hands over the NTLMv2 challenge-response. What is new here is the missing warning: Outlook normally prompts before fetching external content, and this bug suppresses that prompt so the handshake happens silently. A captured NTLMv2 hash can be cracked offline against a weak password, or relayed to any service on the network that still accepts NTLM and does not enforce signing. From there the attacker signs in as the victim and pivots to whatever that account can reach.

Exploitation needs network connectivity and user interaction, which in practice means one click on a message file. Jack Bicer, director of vulnerability research at Action1, argued the Moderate label undersells it: “Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity.” He noted it hits a product nearly every organization runs, and that a stolen hash opens doors well beyond the inbox.

CISA has added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 24, 2026 to patch. Microsoft credited a researcher named Nono and Anthropic’s Benoît Sevens, working with Claude, for the report. Redmond has not named a threat actor, has not described how the bug is being exploited in the wild, and the advisory does not say whether the report arrived before or after attackers started using it.

The rest of the batch includes several remote code execution flaws, in Windows Search (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), the Windows Virtual Filtering Platform (CVE-2026-95962), and the Xbox Live Networking Service (CVE-2026-112967). Azure OpenAI got a privilege escalation fix (CVE-2026-119990). Any of these may matter depending on your exposure, but the Outlook flaw is the one Microsoft has flagged as actively exploited.

That gap is the triage problem watchTowr’s Jake Knott described: “Start with what you actually have exposed to the Internet, then what’s already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation.” For the Outlook bug the prerequisite check is short, since almost everyone runs Outlook and the trigger is a user opening a file.

Patch is the fix. Until it is fully deployed, the standard defenses against NTLM leaks apply: block outbound SMB at the perimeter so a captured handshake has nowhere to go, require SMB signing, and disable NTLM where your environment can tolerate it. Those controls do not undo the missing warning, but they cut the value of any hash this flaw gives up.