🔍 Read the full analysis: Is Your Patch Plan Ready For CISA’s Outlook Zero-Day Deadline? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026. Federal civilian agencies have until Nov. 24 to apply Microsoft’s available Office updates; other organizations are urged to prioritize remediation but are not bound by that deadline.
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog on Nov. 10, giving U.S. federal civilian agencies until Nov. 24, 2026, to apply the available Office security updates. Microsoft says opening a specially crafted file in an affected Outlook version can prompt a connection to an attacker-controlled location and expose a user’s NTLMv2 hash.
Microsoft describes the issue as a spoofing vulnerability that can be triggered when a user opens a malicious Office file. Outlook may connect to a server controlled by an attacker without showing its usual warning about external content. Microsoft says the connection can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user. The attack requires a person to open the file; Microsoft says the Preview Pane is not an attack vector.
Microsoft rates the flaw Moderate and assigns it a CVSS score of 6.5 out of 10. The vulnerability does not itself provide code execution, according to the source material, but the exposed authentication material could create risk for a user and their organization. CISA’s KEV entry says exploitation is active. Its record lists ransomware use as unknown and does not flag the flaw for forensic triage under the relevant directive.
Microsoft lists updates as the fix and provides no workaround in its entry. Fixed versions include Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140, along with November 10 security builds for Microsoft 365 Apps channels. Administrators should check installed build numbers against Microsoft’s release information for the relevant channel and edition. The supplied source lists some Microsoft 365 builds, but its list is cut off before all channel details are provided.
Is Your Patch Plan Ready for CISA’s Outlook Zero-Day Deadline?
CISA added an actively exploited Outlook vulnerability to its KEV catalog. Federal civilian agencies have a fixed date to remediate; other organizations are urged to prioritize the update.
What the flaw can expose
A user must open a specially crafted file in an affected Outlook version for the described attack to work.
Authentication material
Outlook may connect to an attacker-controlled location without its usual warning, exposing the user’s NTLMv2 hash.
Opening the file matters
Microsoft says the Preview Pane is not an attack vector. The flaw does not itself provide code execution.
What the deadline means
The binding requirement applies to federal civilian executive branch agencies.
- Apply vendor updates or follow applicable mitigation instructions by Nov. 24, 2026.
- Discontinue use if mitigation is unavailable.
- The cited directive does not bind them to this deadline.
- CISA urges them to prioritize KEV vulnerabilities through risk-based vulnerability management.
Patch checks for IT teams
Microsoft has released updates; verify installed builds against the release guidance for each product and channel.
Check managed devices for the relevant Outlook and Office edition.
Use Microsoft’s current security release information for the installed channel and edition.
Verify devices reached a fixed build; an enabled update policy alone does not confirm installation.
Why the Outlook Hash Exposure Matters
The issue matters because an Outlook connection can reveal authentication material without the warning users would normally expect. Microsoft says an attacker could use the disclosed hash to authenticate as the affected user. In a workplace environment, an account compromise could expose access to organizational resources, although the source material does not establish that attackers have used this flaw to move through any particular network.
The deadline also separates a binding federal requirement from broader security guidance. CISA’s directive applies to federal civilian executive branch agencies, which must remediate by Nov. 24 or discontinue use if mitigation is unavailable. Microsoft has shipped the fix. Other organizations are not subject to that directive, but CISA urges them to prioritize vulnerabilities in the KEV catalog as part of risk-based vulnerability management.
The flaw’s moderate rating does not mean organizations can disregard evidence of exploitation. The need for a user to open a file limits how the attack works, but does not remove the risk. For IT teams, the immediate practical question is whether affected Office installations have reached a fixed build, rather than whether an update policy merely says updates are enabled.
Products Worth Considering
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Bose SoundLink Max Portable Bluetooth Speaker, IP67 Waterproof, Black
As an affiliate, we earn on qualifying purchases.
From November Patch to KEV Listing
Microsoft’s November security release identifies CVE-2026-124194 as the Microsoft Outlook Spoofing Vulnerability. The source material says it was the only flaw in that month’s Microsoft release marked “Exploitation Detected.” CISA added it to the KEV catalog on Nov. 10, alongside five other vulnerabilities affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium.
CISA’s catalog entry says the addition was based on evidence of active exploitation and sets Nov. 24 as the due date for federal civilian agencies. The required action is to apply mitigations according to vendor instructions, or discontinue use if mitigations are unavailable. In this case, Microsoft has provided software updates. CISA says its directive applies only to federal civilian executive branch agencies and encourages other organizations to prioritize KEV vulnerabilities without imposing the same deadline on them.
Microsoft’s description identifies the missing warning as central to the vulnerability: Outlook can connect to an attacker-controlled network location without displaying its usual external-content warning. The source characterizes the weakness as CWE-356, involving a product interface that does not warn a user about an unsafe action. The attack requires a crafted file and a user’s action, rather than simply viewing the message in the Preview Pane.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its description of CVE-2026-124194
What Is Not Yet Known About Attacks
The available source material does not identify who is behind the exploitation, which organizations or people have been targeted, how many systems may be affected, or when attacks began. CISA lists ransomware use as unknown. The catalog entry also does not call for forensic triage under the cited federal directive, but that status does not establish that no compromises occurred.
The source does not provide a complete list of Microsoft 365 Apps fixed builds across every servicing channel; the listed build information is truncated. Administrators should consult Microsoft’s current security release details for the channel and edition they operate. It is also not clear from the material how many organizations have installed the fixes or whether exploitation has expanded since CISA’s Nov. 10 listing.
Patch Checks Before November 24
Federal civilian agencies must meet CISA’s Nov. 24, 2026, deadline by applying the vendor update, following applicable mitigation instructions, or discontinuing use if a mitigation is unavailable. Because Microsoft has released updates for affected Office products, administrators should verify the installed build on managed devices and address systems that remain on vulnerable versions.
Organizations outside the federal civilian branch are not bound by this date, but CISA recommends prioritizing KEV-listed flaws. IT teams should check Microsoft’s current release guidance for Microsoft 365 Apps and the relevant Office LTSC edition, then confirm deployment rather than relying only on update settings or policy status. Further information about targets, attack duration and any confirmed compromises was not included in the source material.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says opening a specially crafted file in an affected version can make Outlook connect to an attacker-controlled location and disclose the user’s NTLMv2 hash.
Who must meet CISA’s November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize KEV vulnerabilities, but the cited directive does not make the deadline binding on them.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. The described attack requires a user to open the specially crafted file.
What should administrators install?
Microsoft lists Office updates as the fix and no workaround in its entry. Fixed builds named in the source include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024; Microsoft 365 Apps users should check the current release information for their channel.
Do officials know who is exploiting the flaw?
The supplied information does not identify the attackers, targets, number of affected systems or start date of exploitation. CISA lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
