Outlook CVE-2026-124194 NTLM Zero-Day: Patching and Hunting

Microsoft fixed CVE-2026-124194, an exploited zero-day in classic Outlook for Windows, in its November 10, 2026 security release. When a user opens a specially crafted message file, Outlook connects to a network location the attacker controls without showing the usual external-content warning. Windows then authenticates to that server, and the attacker receives the user’s NTLMv2 hash, which Microsoft says “could use this to authenticate as the user”.

Microsoft rates it Moderate, with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), and classes it as a spoofing flaw (CWE-356, the interface does not warn the user of an unsafe action). It is the only vulnerability in the November release that Microsoft lists as exploited. CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a federal deadline of November 24. The score understates the risk: a stolen NTLMv2 hash can be cracked offline for the password, or relayed live to log in to other servers as the user.

Microsoft credits Benoit Sevens, using Claude with Anthropic, and a researcher named nono. Microsoft has not said who is exploiting the flaw, who was targeted, or how the files were delivered.

Affected and fixed versions

The fix ships as an Office update, through Click-to-Run or volume-licensed channels, not through Windows Update. Microsoft lists these products and fixed builds:

Both 32-bit and 64-bit editions are affected. Three points to note:

• Office 2016 and Office 2019 are not in Microsoft’s list. Both left support in October 2025 and get no security updates, so treat any copy still in use as exposed.
• New Outlook for Windows, Outlook on the web, Outlook for Mac and the mobile apps are not listed as affected.
• The Preview Pane is not an attack vector, according to Microsoft. The user has to open the file.

How the attack works

Microsoft’s advisory gives the outline:

• Delivery: an unauthenticated attacker sends the victim “a specially crafted message file” and has to convince them to open it in Outlook. The most likely route is an email attachment or a download link, but Microsoft has not said how the files used in the attacks were delivered.
• Trigger: opening the file makes Outlook connect to a network location the attacker controls, and the warning Outlook normally shows before it loads external content does not appear.
• Result: Windows answers the server’s NTLM challenge with the signed-in user’s NTLMv2 response. That response is what people usually call the NTLM hash leak.

Microsoft has not published which part of the message file holds the remote path. On Windows, a connection to a remote path normally goes over SMB on TCP port 445, and falls back to WebDAV over HTTP or HTTPS when the WebClient service is running. Both send NTLM credentials automatically to a server that asks for them. That is why blocking outbound SMB and restricting outgoing NTLM, below, cut off the attack even before the update is installed.

The outcome is the same as the 2023 Outlook flaw CVE-2023-23397, which leaked NTLM hashes through a crafted calendar reminder without the user opening anything. CVE-2026-124194 needs the user to open the file, which is why it scores lower.

What an attacker does with the hash

• Cracks it offline. An NTLMv2 response is not the password, but weak and medium-length passwords fall quickly to offline cracking. The password then works anywhere the account signs in, including Microsoft 365 if the account is synchronized to Entra ID.
• Relays it live. The attacker forwards the authentication, in real time, to another server and logs in as the user. Relay works against services that do not require signing or channel binding: SMB without signing, LDAP without signing and channel binding, Active Directory Certificate Services web enrollment and Exchange without Extended Protection for Authentication.

The hash of a domain administrator or helpdesk account is the worst case. Through relay to AD CS, an attacker can turn one leaked response into a certificate that keeps working after the password is changed.

Who is exposed, in priority order

1. Privileged users who read email on their admin workstation, such as domain administrators, helpdesk staff and IT service accounts with mailboxes.
2. Networks that allow outbound SMB (TCP 445) to the internet. Without it, the connection to an external server fails unless WebDAV is available.
3. Domains without relay protections: AD CS web enrollment without Extended Protection, LDAP without signing and channel binding, and servers that do not require SMB signing.
4. PCs that have not received the November Office update, including Semi-Annual Enterprise Channel PCs held back by update rings and volume-licensed Office that is patched by hand.
5. Office 2016 and 2019, which will not receive a fix.

How to check your devices

• In Outlook, open File, then Office Account, and read the version and build under About Outlook. Compare it with the table above.
• On Windows, this PowerShell reads the Click-to-Run version and the update channel:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
    Select-Object VersionToReport, CDNBaseUrl, UpdateChannel

VersionToReport reads like 16.0.20527.20196. The last two parts are the build.

• Across the fleet, filter Defender Vulnerability Management or Intune by CVE-2026-124194, or use Hunt 1 below. The Microsoft 365 Apps admin center shows the build per channel for managed tenants.

Mitigation and remediation

1. Install the November 10 Office update. Click-to-Run Office updates itself, but only applies the update when Office apps are closed. To start an update now on a PC, run "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user, or use the Update Now button under File, Office Account. Set an update deadline in your Microsoft 365 Apps or Intune policy so users cannot postpone it.
2. Block outbound SMB to the internet. Block TCP 445 (and 139) from workstations and servers to external addresses at the perimeter firewall, and on the host firewall for laptops that work off the corporate network.
3. Restrict outgoing NTLM. Set the Group Policy “Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers” to Audit all first, review the events, then set it to Deny all with exceptions for the servers that still need NTLM. The setting is RestrictSendingNTLMTraffic under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 (1 audits, 2 denies).
4. Put privileged accounts in Protected Users. Members of the Protected Users group cannot authenticate with NTLM, so their hash is never sent.
5. Close the relay paths. Require SMB signing, require LDAP signing and channel binding on domain controllers, and turn on Extended Protection for Authentication on AD CS web enrollment and Exchange.
6. Stop the WebClient service on PCs that do not need WebDAV, so the attack cannot fall back to HTTP when port 445 is blocked.
7. Quarantine message files from outside. Until the update is everywhere, hold inbound .msg and .oft attachments from external senders at the mail gateway or with a Defender for Office 365 attachment policy. This is our recommendation, not a Microsoft workaround.

Threat hunting

Microsoft has published no indicators. These hunts look for unpatched Outlook, for Outlook reaching external servers over SMB or WebDAV, and for signs that a leaked hash was used.

Example KQL for Microsoft Sentinel and Defender

The KQL below is example code for Microsoft Sentinel and Microsoft Defender for Endpoint. Adapt table and field names to your environment and test each query before relying on it.

Hunt 1: PCs Defender flags for CVE-2026-124194

// Example: Defender XDR, devices with an Office build vulnerable to CVE-2026-124194
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-124194"
| summarize Devices = dcount(DeviceId), Sample = make_set(DeviceName, 20) by SoftwareVendor, SoftwareName, SoftwareVersion
| order by Devices desc

To see which Outlook builds are actually running, whatever is on disk:

// Example: Defender XDR, Outlook builds started in the last day
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "outlook.exe" and isnotempty(ProcessVersionInfoProductVersion)
| summarize Devices = dcount(DeviceId), Sample = make_set(DeviceName, 10) by Version = ProcessVersionInfoProductVersion
| order by Version asc

Compare each build with the fixed builds for that device’s channel in the table above.

Hunt 2: Outlook connecting to external servers over SMB

Outlook has no normal reason to open SMB connections to the internet. Any hit is a lead.

// Example: Defender XDR, Outlook opening SMB or NetBIOS connections to public addresses
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139) and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, ActionType, RemoteUrl
| order by Timestamp desc

Hunt 3: WebDAV connections started for Outlook

When SMB is blocked, Windows can try WebDAV. The WebClient service then runs rundll32.exe with davclnt.dll,DavSetCookie and the remote host on the command line.

// Example: Defender XDR, WebDAV client calls to hosts outside your organization
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rundll32.exe" and ProcessCommandLine has "davclnt.dll" and ProcessCommandLine has "DavSetCookie"
| extend RemoteHost = extract(@"DavSetCookie\s+(\S+)", 1, ProcessCommandLine)
| where RemoteHost !endswith ".contoso.com"    // replace with your own domains
| project Timestamp, DeviceName, AccountName, RemoteHost, ProcessCommandLine
| order by Timestamp desc

Hunt 4: message files opened, then an outbound SMB connection

Opening a .msg file from Explorer or a download starts Outlook with the file on its command line. This joins those launches with any SMB connection to the internet from the same PC in the next five minutes.

// Example: Defender XDR, .msg or .oft files opened in Outlook followed by external SMB
let Opened = DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName =~ "outlook.exe" and ProcessCommandLine matches regex @"(?i)\.(msg|oft)"
    | project OpenedAt = Timestamp, DeviceId, DeviceName, AccountName, ProcessCommandLine;
let Smb = DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemotePort in (445, 139) and RemoteIPType == "Public"
    | project ConnectedAt = Timestamp, DeviceId, RemoteIP, RemotePort, InitiatingProcessFileName;
Opened
| join kind=inner Smb on DeviceId
| where ConnectedAt between (OpenedAt .. OpenedAt + 5m)
| project OpenedAt, ConnectedAt, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessFileName
| order by OpenedAt desc

Hunt 5: SMB leaving the network at the firewall

This catches connections from PCs without Defender, and shows whether your egress rules really block port 445.

// Example: Sentinel, outbound SMB to the internet in firewall logs (CEF)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationPort in (445, 139)
| where ipv4_is_private(SourceIP) and not(ipv4_is_private(DestinationIP))
| summarize Attempts = count(), Allowed = countif(DeviceAction !in~ ("deny", "drop", "block", "reject")),
    Sources = make_set(SourceIP, 20), First = min(TimeGenerated), Last = max(TimeGenerated) by DestinationIP
| order by Allowed desc, Attempts desc

Rows with Allowed above zero mean the firewall let SMB out. Fix that rule first.

Hunt 6: NTLM logons from new places after a leak

A relayed or cracked credential shows up as the user logging on with NTLM from a machine or address they have not used before. This compares the last seven days with the 30 days before.

// Example: Sentinel, NTLM network logons from sources new for that account
let Baseline = SecurityEvent
    | where TimeGenerated between (ago(37d) .. ago(7d))
    | where EventID == 4624 and LogonType == 3 and AuthenticationPackageName =~ "NTLM"
    | distinct TargetUserName, IpAddress;
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 and LogonType == 3 and AuthenticationPackageName =~ "NTLM"
| where TargetUserName !endswith "$" and IpAddress !in ("-", "127.0.0.1", "::1")
| join kind=leftanti Baseline on TargetUserName, IpAddress
| summarize Logons = count(), Computers = make_set(Computer, 10), First = min(TimeGenerated)
    by TargetUserName, IpAddress, WorkstationName
| order by First desc

If you collect the Microsoft-Windows-NTLM/Operational log, event 8001 records each outgoing NTLM authentication with the server name. An external server name or address in event 8001 on a workstation is a direct sign of a leak.

How to tell if a PC was compromised

The leak itself leaves little behind on the PC: Outlook opens a file and makes one connection. Look for these:

• The connection. Hunts 2 to 5 show Outlook, rundll32.exe with davclnt.dll, or the firewall reaching an external server on port 445, 139, 80 or 443 at the time a message file was opened. Note the remote address and the user.
• The file. Find the .msg or .oft file in the user’s Downloads folder, the Outlook temporary attachments folder (%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Outlook\) or the mailbox, and who sent it. Search all mailboxes for the same sender, subject or attachment name.
• Use of the credential. In the hours and days after, check for NTLM logons from new sources (Hunt 6), Entra ID and Microsoft 365 sign-ins from new IP addresses or devices if the account is synchronized, new certificates issued to the account by AD CS, and password changes or MFA registrations nobody requested.

Responding to a suspected leak

1. Reset the user’s password straight away. A leaked NTLMv2 response is only useful until the password changes, unless the attacker already used it.
2. Revoke the user’s sessions and refresh tokens in Entra ID if the account is synchronized, and review MFA methods added since the file was opened.
3. Check AD CS for certificates issued to the account since the leak, and revoke any you cannot account for. A certificate obtained through relay survives the password reset.
4. Block the remote address at the firewall and search the firewall and proxy logs for other PCs that contacted it.
5. Remove the message from every mailbox that received it, and install the Office update on the PC before the user goes back to work.

Indicators of compromise

None have been published. Microsoft’s advisory does not describe the attacks, and CISA’s KEV entry gives no indicators. The hunts above look for behavior for that reason.

Timeline

• March 14, 2023: Microsoft fixes CVE-2023-23397, an earlier Outlook flaw that also leaked NTLM hashes to attacker servers.
• October 14, 2025: Office 2016 and Office 2019 reach end of support.
• November 10, 2026: Microsoft releases the fix in its November security updates, lists CVE-2026-124194 as exploited, and credits Benoit Sevens (using Claude with Anthropic) and nono. CISA adds it to KEV with a November 24 deadline.
• November 24, 2026: CISA’s remediation deadline for US federal agencies.

Frequently Asked Questions

Is CVE-2026-124194 being exploited? Yes. Microsoft marks it “Exploitation Detected” and CISA added it to its Known Exploited Vulnerabilities catalog on November 10. Neither has said who is behind the attacks or who was targeted.

Does opening an email in the Preview Pane trigger it? No. Microsoft says the Preview Pane is not an attack vector. The user has to open the crafted message file itself, for example an attachment or a downloaded file.

Which Outlook versions are affected? Classic Outlook for Windows in Microsoft 365 Apps for enterprise, Office LTSC 2024 and Office LTSC 2021, before the November 10 builds. New Outlook for Windows, Outlook on the web, Outlook for Mac and the mobile apps are not listed.

Does Windows Update install the fix? No. The fix is an Office update. Click-to-Run Office installs it through its own update service, and volume-licensed Office through your usual Office update process.

Is the leaked hash the user’s password? No. It is an NTLMv2 challenge response. An attacker can crack it offline to recover a weak or medium-strength password, or relay it in real time to log in to another server as the user. Long passwords make cracking impractical but do not stop relay.

Will blocking outbound port 445 stop the attack? It stops the SMB route, which is the usual one. Windows can still fall back to WebDAV over HTTP or HTTPS if the WebClient service is running, so also restrict outgoing NTLM or stop WebClient, and install the update.

Why does Microsoft rate an exploited zero-day as only Moderate? The CVSS score counts the need for user interaction and treats the impact as disclosure only. In practice a leaked NTLMv2 hash can lead to account takeover through cracking or relay, which is why CISA put it on a two-week deadline.

We are on Office 2019. What should we do? Office 2019 left support in October 2025 and Microsoft does not list a fix for it. Move those users to Microsoft 365 Apps or Office LTSC 2024, and until then block outbound SMB and restrict outgoing NTLM on their PCs.

How ThreatDefence is responding

ThreatDefence has added CVE-2026-124194 and the fixed Office builds to our vulnerability intelligence. Across all monitored environments, our SOC is:

• identifying PCs running classic Outlook below the November 10 builds, and Office 2016 and 2019 still in use
• alerting on Outlook and the WebDAV client connecting to external servers over SMB or WebDAV, and on SMB leaving the network
• watching for NTLM logons from new sources, unexpected certificate requests and sign-ins from new locations after a message file is opened

If you want help checking your fleet or investigating a suspicious message file, contact us. Read more about our managed detection and response.

Sources

• Microsoft Security Response Center, CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability (November 10, 2026)
• Microsoft Learn, Release notes for Microsoft 365 Apps security updates (November 10, 2026)
• CISA, Known Exploited Vulnerabilities catalog (CVE-2026-124194 added November 10, 2026)
• NVD, CVE-2026-124194
• Microsoft Security Response Center, CVE-2023-23397 Microsoft Outlook Elevation of Privilege Vulnerability
• Microsoft Learn, Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
• Microsoft Learn, Protected Users security group
• Microsoft Learn, Update history for Microsoft 365 Apps
• Microsoft Learn, DeviceNetworkEvents table (Defender XDR advanced hunting)