Outlook flaw lets attackers steal Windows authentication hashes

Microsoft has confirmed active exploitation of an Outlook spoofing flaw that can expose Windows authentication information when a user opens a malicious file. The issue is tracked as CVE-2026-124194 and was patched on November 10, 2026. Microsoft says it was not publicly disclosed before the update.

Affected products and fix status

The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, including both 32-bit and 64-bit editions. Microsoft rates it as moderate with a CVSS score of 6.5, but also marks it as “Exploitation Detected.” That label means the company knows of real exploitation, not only the possibility of a working exploit. Microsoft lists fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024, while Microsoft 365 Apps for Enterprise uses the applicable November 2026 security update for the deployed update channel.

How the attack works

An attacker does not need an account or prior access to the target system. They send a specially crafted message file and rely on the recipient to open it in an affected Outlook version. Successful exploitation needs both user interaction and network connectivity.

Opening the file can make Outlook connect to a network location controlled by the attacker without showing its usual warning about external content. Microsoft classifies the underlying weakness as CWE-356, where a product interface fails to warn users about unsafe actions. The missing warning removes a chance to stop the connection before it happens.

The Preview Pane is outside the attack path. Simply previewing a message does not satisfy the documented exploitation requirements. That separates this case from earlier Outlook attacks covered in Cybersecuritynews.com’s report on Russian hackers exploiting Outlook, which involved a different vulnerability that needed no user action.

What the flaw exposes

According to Microsoft’s advisory, successful exploitation discloses the user’s NTLMv2 hash and may let an attacker authenticate as that user. Microsoft describes this as authentication-data theft, not direct execution of malicious code. It rates confidentiality impact as High and says there is no direct integrity or availability impact.

NTLM-related leaks can support follow-on attacks depending on the receiving service’s protections. Microsoft’s earlier Outlook investigation said captured Net-NTLMv2 data could be used for authentication relay and offline password cracking. Cybersecuritynews.com’s coverage of compromised Ubiquiti routers shows attackers previously using external infrastructure for credential theft, but those details do not establish attribution for this campaign.

Microsoft’s response and admin guidance

Microsoft says administrators should deploy the applicable Office security updates promptly. It also recommends blocking unnecessary outbound SMB traffic on TCP port 445 to the internet. That reduces external SMB exposure, but it does not replace installing the Outlook fix.

Licensed under CC BY-ND 4.0 International