Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in November Patch Tuesday
Microsoft has disclosed CVE-2026-124194, an actively exploited zero-day spoofing vulnerability in Microsoft Outlook. Identified during the November 10, 2026, Patch Tuesday cycle, the flaw allows attackers to deliver specially crafted message files that, upon user interaction, trigger outbound connections to attacker-controlled infrastructure. This mechanism forces the leakage of Windows authentication data, specifically NTLM hashes, facilitating credential theft and potential NTLM relay attacks for lateral movement within enterprise environments. Both Microsoft MSRC and CISA have confirmed in-the-wild exploitation. This vulnerability poses a critical risk to domain identity security and requires immediate patching and monitoring of outbound SMB/NTLM traffic to untrusted external IPs.