Microsoft fixes exploited Outlook zero-day CVE-2026-124194 | Magica
Microsoft patches exploited Outlook flaw that can expose account credentials
Editorial Team
••📖5 min read
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Microsoft patched an actively exploited Outlook flaw rated moderate, with a CVSS base score of 6.5.
Exploitation requires opening a malicious file and network connectivity; the Preview Pane cannot trigger it.
CISA’s catalog lists a November 24 remediation due date, while the reach of the attacks remains unknown.
Microsoft released a security update on November 10 for an actively exploited vulnerability in Outlook, its email application, that can expose authentication information an attacker could use to impersonate a user. Opening a specially crafted message file can cause Outlook to contact an attacker-controlled network location without its usual external-content warning, according to Microsoft’s advisory.
The vulnerability, CVE-2026-124194, carries a CVSS base score of 6.5 and a Microsoft severity rating of moderate. Microsoft says exploitation has been detected and the flaw was not publicly disclosed before the fix. For administrators facing more than 1,000 vulnerabilities in the November release, that is a reason to give it priority even alongside higher-rated bugs.
Reported totals use different counting scopes. BleepingComputer includes 142 Edge vulnerabilities and excludes 108 earlier fixes; the one-vulnerability difference between The Record and SecurityWeek remains unexplained. Source: The Record.
A file opening can become an authentication leak
Microsoft classifies the bug as spoofing and identifies its underlying weakness as a failure to warn users before unsafe actions. An attacker needs no prior authentication, but must persuade the target to open a malicious file in an affected version of Outlook. Exploitation also requires network connectivity. Microsoft explicitly rules out the Preview Pane as a trigger.
Microsoft describes the disclosed authentication material as the user’s NTLMv2 hash and says an attacker could use it to authenticate as that user. A technical account of the release explains that Windows may automatically attempt authentication when connecting to an attacker-controlled network share. Captured authentication hashes could potentially be cracked offline, and recovered credentials could enable access to corporate accounts.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
Microsoft lists affected editions of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, covering both 32-bit and 64-bit installations. Its update table lists build 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024; Microsoft 365 Apps customers are directed to the linked security release notes.
The advisory does not identify the attackers, victims or scale of exploitation. A report on the patches likewise notes the absence of details about the observed attacks. Confirmed exploitation establishes urgency, but does not establish a widespread campaign.
An older authentication mechanism remains consequential
Outlook credential theft has a relevant precedent. In March 2023, Microsoft patched CVE-2023-23397 after detecting limited, targeted abuse of Outlook for Windows to steal NTLM credentials. Microsoft attributed those earlier attacks to a Russia-based actor targeting a limited number of European organizations in government, transportation, energy and military sectors. That vulnerability required no user interaction. Neither its automatic trigger nor its attribution should be transferred to the new flaw, which requires a user to open a file.
NTLM, or NT LAN Manager, is a Windows authentication mechanism that proves knowledge of a password through a challenge-and-response exchange. In its 2023 authentication strategy, Microsoft said Kerberos had been Windows’ default authentication protocol since 2000, but some applications explicitly depended on NTLM and Windows fell back to it when Kerberos could not be used.
Microsoft warned then that disabling NTLM could cause application or authentication failures. Its plan was to expand Kerberos support and improve auditing to reduce NTLM dependence. That history explains the compatibility problem behind retiring the older mechanism; the current advisory establishes that NTLMv2 authentication material is at risk in this Outlook flaw.
A large patch batch complicates the queue
The November release exceeds 1,000 vulnerabilities, but the published totals differ. BleepingComputer counts 1,235, including 142 Microsoft Edge vulnerabilities, and says its headline total excludes 108 flaws fixed earlier in the month. Subtracting those 142 Edge entries yields 1,093, matching The Record’s total. SecurityWeek counts 1,094; the published accounts do not explain that remaining one-vulnerability difference.
Across those differing totals, the reports identify CVE-2026-124194 as the release’s one actively exploited zero-day. The broader November vulnerability list also includes critical Outlook remote-code-execution flaws. The exploited bug warrants priority, while those other fixes remain part of the deployment decision.
CISA added the Outlook flaw on November 10 and lists November 24 as its remediation due date under federal-agency patching policy. Source: CISA.
Deploy the Office fix while the attack picture remains incomplete
The US Cybersecurity and Infrastructure Security Agency, which maintains a catalog of vulnerabilities exploited in the wild to help organizations prioritize remediation, added the Outlook flaw on November 10. Its catalog entry specifies November 24 as the due date, rather than the month-end timing described in The Record’s report. It directs remediation according to vendor instructions, lists ransomware use as unknown and marks forensic triage as not required under its patching directive.
CISA describes that directive, issued in June, as a federal-agency compliance policy and encourages other organizations to use its risk-based approach. The catalog’s due date should be read in that policy context, rather than as a universal deadline for every Outlook customer.
For affected organizations, the immediate decision is deploying the applicable Office update. The outstanding question is what exposure preceded the fix: Microsoft has confirmed exploitation without disclosing its reach. Details about targeting, attack timing and evidence of compromise would help defenders assess whether their users were affected.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
