Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in November Patch Tuesday

Microsoft has disclosed CVE-2026-124194, an actively exploited zero-day spoofing vulnerability in Microsoft Outlook. Identified during the November 10, 2026, Patch Tuesday cycle, the flaw allows attackers to deliver specially crafted message files that, upon user interaction, trigger outbound connections to attacker-controlled infrastructure. This mechanism forces the leakage of Windows authentication data, specifically NTLM hashes, facilitating credential theft and potential NTLM relay attacks for lateral movement within enterprise environments. Both Microsoft MSRC and CISA have confirmed in-the-wild exploitation. This vulnerability poses a critical risk to domain identity security and requires immediate patching and monitoring of outbound SMB/NTLM traffic to untrusted external IPs.

• Vulnerability Characteristics: CVE-2026-124194

  • Zero-day spoofing vulnerability specifically targeting the Microsoft Outlook email client.
  • Patched November 10, 2026, as part of a massive security update addressing approximately 1,090 flaws.
  • Formally flagged by Microsoft MSRC as "Exploitation Detected" prior to public disclosure.

• Exploitation Mechanics: NTLM Credential Theft

  • Attackers deliver a malicious, specially crafted Outlook message file to a target.
  • Exploitation is triggered when a user interacts with and opens the file within Outlook.
  • The application is forced to initiate outbound connections to attacker-controlled infrastructure.
  • These connections leak Windows authentication material, primarily NTLM hashes, to the adversary.

• Threat Impact and Landscape

  • Active exploitation confirmed by both Microsoft MSRC and the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
  • Enables credential theft and facilitates lateral movement via NTLM relay attacks.
  • Released alongside approximately 30 other potentially wormable vulnerabilities.
  • Poses a significant risk to Windows domain identities and enterprise-wide credential integrity.

• Detection and Mitigation Strategies

  • Immediately deploy the November 10, 2026, Microsoft Outlook security updates.
  • Monitor network telemetry for unauthorized outbound SMB or NTLM authentication attempts to external, untrusted IP addresses.
  • Enforce SMB signing and disable legacy protocols, including LLMNR and NBT-NS, to mitigate relay risks.
  • Implement user awareness training to prevent the opening of unsolicited or suspicious Outlook message files.

• Post-Exploitation Remediation

  • Assume potential compromise of domain identities if NTLM hashes were successfully intercepted.
  • Initiate immediate credential rotation for any accounts suspected of being targeted by the exploit.
  • Audit authentication logs for anomalous NTLM relay activity or brute-force attempts.