Microsoft's Patch Tuesday fixes an exploited Outlook zero-day
CVE-2026-124194 lets a crafted message file skip the external-content warning and leak a hash attackers can use to impersonate you, and Microsoft says it is already under attack.
Microsoft’s November Patch Tuesday, released on 10 November, fixed 1,094 vulnerabilities, and one of them was already being exploited: CVE-2026-124194, a spoofing flaw in Outlook. Microsoft rates it only “moderate” with a CVSS score of 6.5, but confirms active exploitation in the wild.
An unauthenticated attacker sends a specially crafted message file and convinces someone to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash, enough for an attacker to impersonate them elsewhere. It cannot be triggered through the Preview Pane, so opening the file is required, and it was not publicly disclosed before the fix shipped. Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
Why it matters: a moderate CVSS score usually means “patch this eventually.” Confirmed exploitation means patch it now, regardless of the label, especially anywhere Outlook handles mail from outside the organisation.
The caveat: Microsoft’s advisory gives no detail on who is behind the attacks or how widely they have used it, only that exploitation is happening.