Is Microsoft Outlook Hacked? Hackers Exploit Zero-Day to Steal Windows Authentication Hashes

Microsoft has confirmed that attackers are actively exploiting a zero-day vulnerability in Microsoft Outlook that could expose Windows authentication information.

Tracked as CVE-2026-124194, the vulnerability allows an unauthenticated attacker to trigger an outbound connection to an attacker-controlled network location when a user opens a specially crafted message file in an affected version of Outlook.

The connection can disclose the user’s NTLMv2 authentication hash without displaying Outlook’s usual external-content warning.

Microsoft addressed the vulnerability in its November 10, 2026 security updates. However, the confirmation of active exploitation makes this a significant security concern for organisations using affected Office applications.

What is the Outlook zero-day vulnerability?

CVE-2026-124194 is classified as a Microsoft Outlook spoofing vulnerability caused by the product interface failing to warn users before a potentially unsafe action.

• CVE ID: CVE-2026-124194
• Product: Microsoft Outlook
• Vulnerability type: Spoofing / authentication information disclosure
• CWE: CWE-356
• CVSS score: 6.5
• Microsoft severity: Moderate
• Exploitation status: Exploitation detected
• Patch release: November 10, 2026

Although Microsoft rates the vulnerability as Moderate, confirmed exploitation means organisations should prioritise installing the security update.

How are attackers exploiting Outlook?

The attack involves a specially crafted message file sent to a potential victim.

The attacker does not need an existing account or prior access to the target’s system. However, the victim must be convinced to open the malicious file in an affected Outlook version.

The documented attack sequence is:

1. An attacker sends a specially crafted message file to a target.
2. The recipient opens the file using an affected Outlook application.
3. Outlook connects to a network location controlled by the attacker.
4. The connection can disclose the user’s NTLMv2 authentication hash.
5. The captured authentication information may be used in follow-on impersonation attempts.

Important: Microsoft states that successful exploitation requires user interaction and network connectivity. Simply viewing a message in Outlook’s Preview Pane is not identified as an attack vector for this vulnerability.

What can hackers do with stolen NTLMv2 hashes?

NTLMv2 is an authentication protocol used by Windows environments. Its challenge-response authentication data is not the same as a user’s plaintext password.

If an attacker captures an NTLMv2 hash, it may create opportunities for further attacks, depending on the organisation’s authentication configuration and network protections.

Potential risks include:

• Credential impersonation: Captured authentication material may be used in attempts to authenticate as the affected user.
• NTLM relay attacks: Authentication exchanges may be relayed to other systems where protections are insufficient.
• Offline password cracking: Attackers may attempt to recover the underlying password from captured authentication material.
• Further network access: If authentication succeeds, an attacker may attempt to access resources available to the compromised account.

The vulnerability itself does not establish that attackers have obtained plaintext passwords, executed arbitrary code or compromised every affected organisation.

Which Microsoft products are affected?

Microsoft identifies the following affected products:

• Microsoft 365 Apps for Enterprise
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024

The vulnerability affects applicable unpatched versions of these products. Organisations should check the installed Office build and update channel rather than assuming every Outlook edition is affected.

Microsoft releases security patches

Microsoft released fixes as part of its November 10, 2026 Office security updates.

The following fixed builds are listed for the perpetual LTSC editions:

Microsoft 365 Apps for Enterprise users should install the applicable November 10 security update for their update channel.

For example, the November 10 Current Channel release is Version 2610, Build 20527.20196. Other enterprise channels have their own corresponding fixed builds.

Organisations should consult Microsoft’s official Office security release notes before deployment.

CISA adds the vulnerability to its Known Exploited Vulnerabilities catalog

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) Catalog on November 10, 2026.

The catalog lists vulnerabilities for which there is evidence of exploitation in the wild.

CISA assigned a remediation due date of November 24, 2026, for applicable US federal civilian agencies.

CISA’s catalog lists known ransomware campaign use as unknown. This means there is no confirmed basis to claim that this Outlook vulnerability is being used in a ransomware campaign.

How to protect your Outlook account and organisation

Microsoft’s November security update should be installed as a priority.

Recommended security measures include:

1. Install the latest Office security updates: Update Microsoft 365 Apps and supported Office LTSC installations to the applicable fixed builds.
2. Restrict outbound SMB traffic: Block unnecessary outbound SMB connections over TCP port 445 to the internet.
3. Review NTLM usage: Restrict or reduce unnecessary NTLM authentication where operationally possible.
4. Treat unexpected message files as suspicious: Avoid opening unsolicited or unexpected Outlook message files.
5. Monitor authentication activity: Investigate unusual outbound authentication attempts and unexpected NTLM activity.
6. Review potentially exposed accounts: If a suspicious file was opened before patching, notify the security team and investigate possible credential exposure.

Updating Office is the primary remediation. Network restrictions provide an additional layer of protection.

Is the Microsoft Outlook outage related to this zero-day?

No connection between the two incidents has been established.

Microsoft also experienced a widespread Microsoft 365 and Outlook service disruption on November 12, 2026. That incident involved service connectivity and infrastructure availability.

The CVE-2026-124194 vulnerability is a separate security issue involving the disclosure of Windows authentication information through a specially crafted message file.

A service outage does not prove that a system has been hacked, and the existence of an exploited zero-day does not prove that it caused the outage.

Frequently Asked Questions (FAQs)

CyberNexora News | Cybersecurity Updates & Insights

Stay informed about zero-day vulnerabilities, active cyberattacks, data breaches, security patches and emerging cybersecurity threats.