Microsoft patched CVE-2026-124194 in its November 10, 2026 Patch Tuesday release, describing a spoofing flaw in Outlook that exposes NTLMv2 authentication information. The bug carries a CVSS 3.1 score of 6.5 and a Moderate rating, yet Microsoft confirmed it has already been exploited in attacks.

An unauthenticated remote attacker can send a specially crafted message file and, once the victim opens it, Outlook connects to an attacker-controlled network location without showing the external-content warning users would normally see.

During that connection, Windows may hand over NTLMv2 authentication material that can be abused to impersonate the victim. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, both 32-bit and x64.

The Moderate 6.5 rating reflects required user interaction and a confidentiality-only impact, but both SOC Prime and eSecurity Planet argue exploitation status should drive urgency.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, setting a November 24, 2026 remediation deadline for U.S. federal agencies.

According to eSecurity Planet, Action1 vulnerability research director Jack Bicer warned the rating understates the risk and urged immediate Outlook updates, starting with administrators and other high-value accounts.

Notably, eSecurity Planet reports Microsoft's acknowledgment credits researcher Benoît Sevens, with SecurityWeek noting the reference to using Anthropic's Claude AI model during the research.

No campaign-specific IOCs have been published — Microsoft has not disclosed the threat actors, victim organizations, delivery infrastructure, or whether stolen hashes were used for lateral movement — so defenders must hunt behaviorally.

SOC Prime highlights a key signal: OUTLOOK.EXE initiating outbound SMB traffic, especially TCP port 445, to an external or previously unseen destination shortly after a user opens a message file.

Other pivots include NTLM authentication attempts toward internet destinations and new logons from systems inconsistent with a user's normal activity.

Microsoft's advisory states the Preview Pane is not an attack vector, meaning merely displaying the message is insufficient — the file must be opened. SOC Prime cautions that not every outbound SMB or NTLM connection proves exploitation, since both remain legitimate in many enterprises.

The primary fix is November 2026 Office security updates: Office LTSC 2021 should run build 16.0.14334.21048 or later, Office LTSC 2024 needs 16.0.17932.21140 or later, and Microsoft 365 Apps should verify the current security release per servicing channel.

Because exploitation is already underway, organizations should verify deployment rather than assume automated updates reached every device.

Microsoft recommends blocking outbound SMB to the internet and auditing outgoing NTLM via the NTLM Operational log, with the Restrict NTLM outgoing-traffic policy configurable in audit mode first.

The flaw sits inside a Patch Tuesday release fixing more than 1,000 vulnerabilities, including 63 Critical ones; per eSecurity Planet, the most serious include a 9.8-scored LDAP remote code execution that could compromise domain controllers, Windows Search and Exchange RCE, and an Azure OpenAI privilege escalation.