🔍 Read the full analysis: Outlook Zero-Day Under Attack: A Guide To CISA’s Patch Deadline on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Microsoft says attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash after the user opens a crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10 and set a Nov. 24 patch deadline for U.S. federal civilian agencies; Microsoft says an Office update is the fix.
CISA has set November 24, 2026, as the deadline for U.S. federal civilian agencies to address CVE-2026-124194, an Outlook vulnerability that Microsoft says attackers are already exploiting. Microsoft says a user who opens a specially crafted file in an affected Outlook version could expose an NTLMv2 authentication hash; the company lists an Office security update, rather than a workaround, as the fix.
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 10, citing evidence of active exploitation. Its directive applies to federal civilian executive branch agencies, which must follow the November 24 deadline. CISA encourages other organizations to prioritize KEV-listed vulnerabilities, but the federal deadline is not a general legal requirement for private companies.
Microsoft describes an attack in which an attacker sends a malicious Office file and persuades a user to open it in Outlook. The application may then connect to an attacker-controlled network location without the usual external-content warning. Microsoft says that connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as the user.
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 among the affected products, in both 32-bit and 64-bit editions. Its listed fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps updates vary by channel; administrators should check Microsoft’s security release details for the applicable build. The source material does not provide the complete channel-by-channel build list.
Outlook Zero-Day Under Attack CISA’s Patch Deadline
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Federal civilian agencies must address it by November 24, 2026.
How the attack works
The described attack requires a user to open a specially crafted file in an affected Outlook version.
A user opens a malicious file in affected Outlook; Preview Pane is not an attack vector.
Outlook may connect without the usual external-content warning.
The NTLMv2 hash could be used by an attacker to authenticate as the user.
Who must act
CISA’s deadline applies to federal civilian executive branch agencies.
- Meet the November 24 deadline.
- Apply Microsoft’s instructions or discontinue use if mitigations are unavailable.
- The federal deadline is not a general legal requirement for private companies.
- CISA encourages risk-based prioritization of KEV-listed flaws.
The fix is an Office update
Check installed builds on affected systems; Microsoft 365 Apps updates vary by channel.
| Product | Fixed build information |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check the applicable channel’s release details |
What is still unknown
The supplied information confirms active exploitation but gives limited incident detail.
- Who is behind the attacks and which organizations were targeted are not identified.
- The number of affected users and when attacks began are not provided.
- Ransomware use is listed as unknown; the information does not establish that ransomware was involved.
Why the Outlook Hash Exposure Matters
The vulnerability does not, by itself, give an attacker a route to run code on a victim’s computer, according to the supplied account of Microsoft’s assessment. The attack also depends on a person opening a malicious file. But the potential disclosure of a user authentication hash makes the issue relevant beyond the individual Outlook message: Microsoft says an attacker could use the hash to authenticate as that user.
That risk helps explain why the flaw has an agency deadline despite Microsoft rating it Moderate, with a CVSS score of 6.5 out of 10. For organizations, the practical priority is to verify that affected Office installations have received the relevant fixed build. CISA’s deadline makes that task time-bound for federal civilian agencies; other organizations are urged to use risk-based prioritization.
Popular right now
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
De'Longhi Classic Signature Espresso Machine
As an affiliate, we earn on qualifying purchases.
From Microsoft’s Alert to CISA’s Deadline
Microsoft’s security entry identifies the issue as the Microsoft Outlook Spoofing Vulnerability. The source material says it was the only flaw in Microsoft’s November release marked “Exploitation Detected.” CISA added it to the KEV catalog on November 10 as one of six vulnerabilities across several vendors, stating that the additions were based on evidence of active exploitation.
CISA’s catalog sets November 24 as the due date and tells agencies to apply mitigations according to vendor instructions, or discontinue use of a product if mitigations are unavailable. Microsoft has issued updates for the affected Office products. The source material says CISA’s directive applies only to federal civilian executive branch agencies and separately encourages all organizations to prioritize vulnerabilities in the KEV catalog.
Microsoft says the attack requires a user to open the malicious file and that the Preview Pane is not an attack vector. The flaw is categorized as a product interface failing to warn users about a potentially unsafe action. These details describe the attack conditions; they do not establish how particular victims were selected or how frequently the flaw has been used.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, as quoted in its security entry
What Is Known About the Attacks
The supplied source material does not identify who is behind the exploitation, which organizations or users were targeted, how many may have been affected, or when attacks began. CISA’s catalog lists use in ransomware campaigns as unknown; that entry does not establish that ransomware has been used in these attacks.
The vulnerability’s presence in the KEV catalog confirms CISA’s assessment that there is evidence of active exploitation, but the source material provides no incident counts or public details about specific intrusions. It also says the catalog’s forensic-triage field is not marked for this flaw. That does not, on its own, establish whether a particular organization has been compromised or whether it should conduct its own investigation.
Microsoft lists no workaround or separate mitigation in the information provided. The stated remedy is to install the applicable Office update. The complete list of Microsoft 365 Apps fixed builds is not included in the source material, so administrators need to consult Microsoft’s release information for their update channel.
Patch Checks Before November 24
Federal civilian agencies must meet CISA’s November 24, 2026, deadline by applying Microsoft’s instructions. IT teams should check the installed Office build on affected systems rather than assume that an update policy has already delivered the patch. Microsoft 365 Apps users should confirm the build against the release information for their specific channel.
Organizations outside the federal civilian branch are not subject to this deadline under the directive described here. CISA nevertheless recommends prioritizing KEV vulnerabilities. Microsoft and CISA may publish further technical or incident information, but the supplied material does not announce another milestone or say whether additional details about the attacks are expected.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook vulnerability that Microsoft describes as a spoofing flaw. Opening a specially crafted file in an affected Outlook version can cause a connection to an attacker-controlled location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Who must meet CISA’s November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the directive cited by CISA. CISA encourages other organizations to prioritize KEV-listed flaws, but the stated federal deadline does not apply to every organization.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open a malicious file in an affected version of Outlook.
What should organizations install?
Microsoft lists an Office update as the fix and provides fixed builds for Office LTSC 2021 and 2024. Microsoft 365 Apps builds differ by servicing channel, so administrators should check Microsoft’s security release information for the version they use.
Is this flaw linked to ransomware?
The available source material does not confirm a ransomware connection. CISA’s catalog lists the use of the vulnerability in ransomware campaigns as unknown.
Source: ThorstenMeyerAI.com
