SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-11

Microsoft Outlook CVE-2026-124194: exploited zero-day leaks NTLMv2 hashes from a crafted message file, fixed in November Patch Tuesday

SockAnalyst · Security+ certified analyst.

What happened

Microsoft's November 10, 2026 Patch Tuesday fixed CVE-2026-124194, an Outlook spoofing flaw that Microsoft marks as exploited. An unauthenticated attacker sends a specially crafted message file and convinces a user to open it; Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which can disclose the user's NTLMv2 hash for relay or offline cracking. Microsoft rates it Moderate with CVSS 6.5, and says the Preview Pane is not an attack vector, so the file has to be opened. CISA added it to the KEV catalog the same day with a federal due date of November 24. It is the only exploited flaw in a release that fixed roughly 1,090+ CVEs (reported counts vary by outlet).

Who's affected

Organizations running Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 (32- and 64-bit) that have not installed the November 10, 2026 Office security update. Users who open message files from email or downloads are the target.

✅ Fix / patch

  • Install the November 10, 2026 Office security update. Microsoft's Office release notes list Current Channel Version 2610 (Build 20527.20196), Office LTSC 2024 Build 17932.21140 and Office LTSC 2021 Build 14334.21048.
  • Microsoft 365 Apps update on their own channel: force the update through Intune/Configuration Manager, or have users run File > Office Account > Update Options > Update Now.
  • Block outbound SMB (TCP 445) and WebDAV to the internet at the perimeter so a leaked authentication attempt cannot reach an attacker server.
  • Consider adding high-value accounts to the Protected Users group and restricting outgoing NTLM traffic to remote servers where your environment allows it.
  • Warn users about unexpected message-file attachments until every client is patched.

🔎 Quick hunt check

Neither Microsoft nor CISA has published IOCs or attribution for this exploitation. Hunt for OUTLOOK.EXE (or a process it spawned) making outbound SMB (445) or WebDAV/HTTP connections to public IP addresses, and for message-file attachments (.msg/.eml) opened from email or downloads shortly before those connections.

MITRE ATT&CK: T1566.001, T1187, T1204.002

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=edr (process_name="OUTLOOK.EXE" OR parent_process_name="OUTLOOK.EXE") (dest_port=445 OR dest_port=139 OR dest_port=80)
| where NOT cidrmatch("10.0.0.0/8",dest_ip) AND NOT cidrmatch("172.16.0.0/12",dest_ip) AND NOT cidrmatch("192.168.0.0/16",dest_ip) AND NOT cidrmatch("127.0.0.0/8",dest_ip)
| eval proto=case(dest_port IN (445,139),"SMB",true(),"HTTP/WebDAV")
| stats count min(_time) as first_seen values(dest_ip) as dest values(proto) as proto by host, user, process_name
// CVE-2026-124194: Outlook reaching external SMB/WebDAV hosts (possible NTLMv2 hash leak); tune out known mail/CDN destinations
let msgOpens = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".msg" or FileName endswith ".eml"
| project DeviceId, OpenTime=TimeGenerated, FileName;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where RemotePort in (445, 139, 80)
| where RemoteIPType == "Public"
| join kind=leftouter msgOpens on DeviceId
| where isempty(OpenTime) or TimeGenerated between (OpenTime .. OpenTime + 10m)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, FileName
// CVE-2026-124194: Outlook outbound SMB/WebDAV to public IPs, optionally after a message file was written

See all hunt queries →

⏱ CISA deadline

CVE-2026-124194CVSS 6.5 Medium (v3.1, CNA)
--
Federal due 2026-11-24 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →