🔍 Read the full analysis: Patch Outlook Now: CISA’s Deadline For The Zero-Day Is November 24 on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CISA added Microsoft Outlook vulnerability CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on Nov. 10, citing evidence of active exploitation. Federal civilian agencies must apply available Microsoft updates by Nov. 24; CISA urges other organizations to prioritize the flaw, but the deadline is not binding on them.
CISA added Microsoft Outlook vulnerability CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026, citing evidence of active exploitation, and set Nov. 24 as the remediation deadline for U.S. federal civilian agencies. Microsoft has released Office updates that fix the flaw, which can expose a user’s NTLMv2 authentication hash if they open a specially crafted file in an affected Outlook version.
Microsoft describes the issue as a spoofing vulnerability. A malicious file sent by an attacker must be opened by the recipient in an affected Outlook version. Microsoft says Outlook may then connect to an attacker-controlled network location without showing its usual external-content warning, potentially disclosing the user’s NTLMv2 hash. The company says an attacker could use that hash to authenticate as the user.
Microsoft rates the vulnerability Moderate and assigns it a CVSS score of 6.5 out of 10. The attack requires user action, but does not require the attacker to have an account on the target system. Microsoft says the Preview Pane is not an attack vector. The issue does not, according to the source material, provide a direct route to running code.
CISA’s Nov. 10 alert added six vulnerabilities to its KEV catalog based on evidence of active exploitation. For CVE-2026-124194, the catalog instructs covered agencies to apply vendor mitigations by Nov. 24, or discontinue use of a product if mitigation is unavailable. Microsoft has published updates, and lists no workaround or separate mitigation for this flaw.
Microsoft lists Office LTSC 2021 and 2024, along with Microsoft 365 Apps, among the affected products. The fixed builds specified in the source material are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps fixes were included in the Nov. 10 releases for its update channels; administrators should check Microsoft’s release information for the applicable channel and build.
Patch Outlook Now CISA’s November 24 Deadline
CISA confirms active exploitation of an Outlook flaw that can expose authentication hashes. Federal civilian agencies must install Microsoft’s update by November 24; other organizations are urged to prioritize it.
How the attack works
The risk requires a user to open a specially crafted file in an affected Outlook version.
A recipient opens an attacker’s file in an affected Outlook version.
Outlook may connect to an attacker-controlled location and disclose the user’s NTLMv2 hash.
Microsoft says an attacker could use the hash to authenticate as the user.
Who must act by the deadline?
The directive sets a binding date for federal civilian agencies; CISA encourages other organizations to prioritize KEV-listed flaws.
- Apply the available Microsoft update by November 24.
- If mitigation is unavailable, discontinue use of the product.
- The directive’s deadline does not apply to them.
- CISA recommends prioritizing KEV vulnerabilities through risk-based management.
Confirm the right Office build
Inventory installations and check the applicable update channel before confirming deployment.
| Product | Fixed build or action |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check Microsoft’s release information for the applicable channel and build. |
What is known—and unknown
Active exploitation
CISA cited evidence of active exploitation when it added CVE-2026-124194 to its KEV catalog.
Preview Pane
Microsoft says the Preview Pane is not an attack vector; a user must open the file.
Scope and attribution
The available information does not identify targets, incident counts, attackers, or whether ransomware was involved.
A Stolen Hash Can Expose Accounts
The risk is not that opening the file automatically runs a program, but that it can expose authentication material that may be useful to an attacker. Microsoft says the disclosed NTLMv2 hash could be used to authenticate as the affected user. In an organization, compromised credentials can create a route to further access, although the source material does not establish that attackers have used this flaw to move through networks or access particular systems.
The listing makes the issue time-sensitive for federal civilian agencies, which are subject to the Nov. 24 deadline under the applicable directive. Other organizations are not bound by that date, but CISA explicitly encourages them to prioritize vulnerabilities in the KEV catalog. The practical response is to identify affected Office installations and confirm that the relevant security update is installed rather than relying on a general update policy.
The vulnerability’s moderate rating does not cancel out the active-exploitation designation. Those labels describe different aspects of the issue: Microsoft’s severity assessment and CISA’s evidence that attackers are using it. The available information does not quantify incidents, affected organizations or the scale of exploitation.
Products Worth Considering
Canon IVY 2 Mini Photo Printer Bundle, Blush Pink
FLEXISPOT Electric Adjustable Workbench, 55 x 28 Inches, White
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
As an affiliate, we earn on qualifying purchases.
From Microsoft Patch to CISA Listing
Microsoft’s November security information identifies CVE-2026-124194 as the Microsoft Outlook Spoofing Vulnerability. The source material says it was the only flaw in Microsoft’s November release marked “Exploitation Detected.” CISA added it to the KEV catalog on Nov. 10, citing evidence of active exploitation, and assigned the remediation date of Nov. 24.
The deadline applies under Binding Operational Directive 26-04 to federal civilian executive branch agencies, not to every U.S. organization or private company. CISA’s alert says the directive applies only to those agencies, while urging all organizations to use risk-based vulnerability management and prioritize KEV-listed issues.
CISA’s catalog entry identifies ransomware use as unknown and does not mark this flaw for forensic triage under the directive. Its risk fields describe exploitation as active, automatable as no, and technical impact as partial. The source article interprets those details as pointing toward attacks that require a person to open a file; that interpretation is not itself a CISA conclusion.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its vulnerability description
Attack Scope Remains Unknown
The available information does not identify who is behind the attacks, which organizations or users have been targeted, how many may have been affected, or when exploitation began. CISA’s listing confirms evidence of active exploitation but does not provide those details in the source material.
It is also unknown whether the flaw has been used in ransomware campaigns; CISA’s entry lists that field as unknown. The catalog does not mark the issue for forensic triage, but that status should not be read as proof that no compromise has occurred. The source material provides no incident count or account of specific intrusions.
The affected Microsoft 365 Apps build details in the supplied source are incomplete for some channels. Administrators should consult Microsoft’s current security-release information to confirm the fixed build for each deployment, rather than assuming that one version number applies across all update channels.
Verify Office Builds Before Nov. 24
Federal civilian agencies are required to meet the Nov. 24, 2026, deadline by applying the available vendor update, following the directive’s remediation instructions. IT teams should inventory Office LTSC and Microsoft 365 Apps installations, check each installation’s version and build, and confirm that the relevant update has been deployed.
Organizations outside the federal civilian executive branch are not subject to this deadline under the directive. CISA nevertheless recommends that all organizations prioritize KEV vulnerabilities. Microsoft’s published update is the identified fix for this issue; the source material lists no workaround.
Further details about the attacks, including attribution, targets and their duration, may emerge through later advisories or incident reporting. Until then, the confirmed actions are to verify the applicable Office build and install Microsoft’s update, while treating the extent of exploitation as unknown.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says opening a specially crafted file in an affected Outlook version can cause a connection to an attacker-controlled network location and expose the user’s NTLMv2 hash.
Does the flaw affect the Outlook Preview Pane?
No. Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the malicious file.
Who must meet the Nov. 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies covered by Binding Operational Directive 26-04. CISA recommends that other organizations prioritize the vulnerability, but the supplied alert does not make the deadline binding on them.
What should administrators do to fix it?
Install the applicable Microsoft security update and check that affected Office installations are running a fixed build. The source material lists no workaround; Microsoft’s update is the identified fix. Microsoft 365 Apps administrators should verify the build for their specific update channel.
Do officials know who is exploiting the flaw or how many were affected?
The source material does not identify the attackers, targets, start date or number of affected users or organizations. CISA says there is evidence of active exploitation, while the scale and details remain unknown.
Source: ThorstenMeyerAI.com
