Outlook zero-day leaks Windows sign-in hashes when a crafted message file is opened (CVE-2026-124194)

11 November 2026High 6.5Being exploited

Microsoft · Microsoft Outlook · CVE-2026-124194

Outlook zero-day leaks Windows sign-in hashes when a crafted message file is opened

If someone opens a specially crafted message file, Outlook connects to an attacker's server without showing its usual external content warning, handing over the user's NTLMv2 hash. Microsoft says an attacker could use that hash to authenticate as the user, and that the flaw was exploited before the fix shipped in the November updates. The preview pane is not a way in: the file has to be opened.

Affected: Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit editions), per Microsoft's advisory.
What to do: Install the November 2026 Office security updates. Microsoft's advisory points to the Office release notes for the fixed builds rather than a Windows update, so check that Office itself is updating on each PC. Remind staff not to open unexpected message file attachments.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: The one exploited zero-day in November's Patch Tuesday; on CISA's catalogue; Outlook is the everyday email app in most offices.

Outlook zero-day leaks Windows sign-in hashes when a crafted message file is opened

Affected

Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit editions), per Microsoft's advisory.

What to do

Install the November 2026 Office security updates. Microsoft's advisory points to the Office release notes for the fixed builds rather than a Windows update, so check that Office itself is updating on each PC. Remind staff not to open unexpected message file attachments.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

The one exploited zero-day in November's Patch Tuesday; on CISA's catalogue; Outlook is the everyday email app in most offices.