Outlook flaw lets attackers steal Windows authentication hashes
Microsoft has confirmed active exploitation of an Outlook spoofing flaw that can expose Windows authentication information when a user opens a malicious file. The issue is tracked as CVE-2026-124194 and was patched on November 10, 2026. Microsoft says it was not publicly disclosed before the update. Affected products and fix status The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, including both 32-bit and 64-bit…