Microsoft Patches Actively Exploited Outlook Zero-Day CVE-2026-124194 Allowing NTLMv2 Hash Theft
Microsoft fixed an actively exploited spoofing vulnerability in Outlook during its November Patch Tuesday, which allows attackers to silently steal NTLMv2 hashes and impersonate users.
In its November Patch Tuesday release, Microsoft addressed over 1,000 security vulnerabilities, with particular attention drawn to CVE-2026-124194 in Outlook due to detected exploitation activity. This flaw allows unauthenticated attackers to send specially crafted message files that, when opened by a user in Outlook, cause the application to connect to an attacker-controlled network location without displaying the usual warning for accessing external content.
Successful exploitation enables attackers to obtain NTLMv2 hash data, potentially allowing them to impersonate the user. The vulnerability has a CVSS severity score of 6.5. Microsoft urges users to install the patch promptly to mitigate these spoofing attacks.