Summary
- CVE-2026-124194 is a Microsoft Outlook vulnerability rated CVSS 6.5 and confirmed as exploited.
- Opening a specially crafted message file can prompt contact with an attacker-controlled resource and disclose NTLMv2 authentication material.
- The vulnerability requires user interaction; Microsoft has released corrections, and CISA listed it as known exploited.
An actively exploited vulnerability in Microsoft Outlook can expose Windows authentication material when a user opens a malicious message file, creating a potential route for attackers to abuse enterprise identities.
Microsoft addressed the weakness, CVE-2026-124194, in its November security updates on 10 November. The vulnerability carries a CVSS score of 6.5, but Microsoft has confirmed exploitation in the wild.
The flaw affects Outlook’s handling of specially crafted message files. Under the documented attack conditions, opening one can cause the application to connect to an attacker-controlled network resource without presenting the warning normally associated with potentially unsafe external content.
That connection may disclose the user’s NTLMv2 authentication material, which attackers could potentially abuse in subsequent authentication attempts.
The issue requires user interaction. Microsoft’s advisory indicates that Outlook’s Preview Pane is not an attack vector, meaning the documented vulnerability should not be described as an exploit triggered merely by previewing an email.
The distinction is important because vulnerabilities affecting email clients can involve very different mechanisms. Some flaws can be triggered automatically when a message is processed, while others require a recipient to open an attachment or message file.
Authentication material creates secondary risk
NTLM is a Microsoft authentication protocol still encountered in many Windows enterprise environments, particularly where older applications, services or compatibility requirements remain.
NTLMv2 challenge-response material is not the same as a plaintext account password. However, disclosure can create opportunities for authentication attacks, depending on the environment, available services and the protections applied to subsequent connections.
In some circumstances, attackers may attempt to relay authentication to another service or otherwise exploit captured material. Successful compromise depends on configuration and additional conditions; the vulnerability does not automatically grant access to every service associated with the affected user.
Nevertheless, the risk extends beyond the email application because enterprise authentication identities may be trusted by file services, administrative tools and other network resources.
The core weakness involves the failure to provide an appropriate warning before Outlook performs an unsafe action. Microsoft classifies CVE-2026-124194 as a spoofing vulnerability, although its practical consequence involves potential disclosure of sensitive authentication information.
That difference between classification and operational impact makes the vulnerability more consequential than its label may initially suggest.
The affected software includes Microsoft 365 Apps for Enterprise and supported Office Long-Term Servicing Channel releases, including Office LTSC 2021 and 2024, subject to the versions specified by Microsoft.
Administrators must therefore assess their Office deployment channels and installed builds rather than assuming that every Outlook installation receives the same update package.
Known exploitation changes patch priorities
The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue on 10 November, reflecting evidence that attackers have used the weakness.
The catalogue entry establishes exploitation status but does not identify the responsible threat actors, affected organisations or number of successful compromises.
Researchers reviewing Microsoft’s November update identified the Outlook flaw as the only vulnerability in that release marked as actively exploited at the time of publication.
The wider update includes numerous other security fixes across Windows, Office, enterprise identity systems and supporting components. Published totals differ depending on how vulnerabilities are counted, particularly where browser-related and previously issued CVEs are included.
Those differences do not alter the priority of the Outlook correction, which concerns an exploitation route already observed in the wild.
The immediate exposure depends partly on how Outlook handles the malicious file and whether the user’s computer can authenticate to attacker-controlled network destinations. Network egress restrictions and protections against unsafe outbound authentication can reduce opportunities for credential disclosure.
Organisations that have previously restricted NTLM use may also face a different risk profile from environments relying extensively on legacy authentication mechanisms. Such controls are complementary to the software update rather than substitutes for correcting the vulnerability.
Successful defence further depends on visibility into unusual outbound authentication behaviour. Where Outlook initiates authentication to unexpected external systems, the resulting events can provide evidence for incident investigation, although a network connection alone does not confirm malicious exploitation.
Microsoft’s published advisory provides the affected-product information and corresponding remediation details. CISA’s inclusion of the flaw in its exploited-vulnerabilities catalogue establishes an additional reason to prioritise correction in exposed enterprise environments.
The company has not publicly identified the attackers or the campaigns responsible for the confirmed exploitation.
