Outlook CVE-2026-124194: exploitation detected — update and verify

Microsoft says exploitation of Outlook CVE-2026-124194 has been detected. Practical guidance: update affected installations and verify the build.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Laptop showing a generic mail interface, warning triangle, attachment, network path to a server, and blue shield.
AI-generated conceptual editorial illustration of a mail attachment and network-authentication risk; not an official Microsoft image or documentary evidence.

Security advisory

Microsoft says exploitation of Outlook CVE-2026-124194 has been detected.1

Practical guidance: update affected Outlook installations and verify the installed build.123

Reporting cutoff: November 10, 2026, 5:54:18 p.m. EST (November 10, 2026, 22:54:18 UTC).

What is confirmed

Microsoft classifies the issue as a Moderate spoofing vulnerability with CVSS 3.1 base score 6.5.1

The exposure predicate is specific: a device must run an affected Outlook product, the user must open a specially crafted message file, and Outlook must have network connectivity.1

Microsoft says the Preview Pane is not an attack vector.1

Opening the crafted file can make Outlook connect to an attacker-controlled network location without the usual external-content warning.1

Microsoft says the disclosed NTLMv2 hash could be used to authenticate as the user.1

Who is exposed

Affected Windows products are Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, in both 32-bit and x64 editions.1

Product Minimum fixed build at cutoff
Office LTSC 2021 16.0.14334.2104812
Office LTSC 2024 16.0.17932.2114012
Microsoft 365 Apps for Enterprise Use the build for the configured update channel12

For Office LTSC 2021, the fixed minimum is build 16.0.14334.21048; for Office LTSC 2024, it is 16.0.17932.21140.12

For Microsoft 365 Apps, the fixed build depends on the configured update channel.12

Microsoft’s November 10 security release lists Current Channel Version 2610 (Build 20527.20196).2

CISA added CVE-2026-124194 to KEV on November 10, 2026, set a November 24, 2026 due date, and lists known ransomware use as Unknown.4

Patch and verify

  1. In classic Outlook or another Office app, open File > Account (or Office Account), then select Update Options > Update Now.3
  2. If Update Options is missing, Microsoft says a volume-license install or Group Policy may manage updates; use the organization’s managed update path or contact its help desk.3
  3. After updating, compare the full installed version and build with the row for the device’s actual channel or LTSC release.12
  4. Do not treat Preview Pane safety as proof that the message file is safe to open.1

Detection limits and incident-response cautions

NTLM audit events are recorded under Applications and Services Log\Microsoft\Windows\NTLM only when the relevant audit policy is enabled.5

Because logging depends on prior audit configuration and event-log retention, an empty NTLM operational log cannot prove that no disclosure occurred.57

Microsoft recommends auditing existing NTLM use before denying all outgoing NTLM traffic because blocking can affect compatibility.5

If investigation indicates credential compromise, Microsoft recommends disabling the affected account during the investigation, revoking active sessions, and reviewing sign-in and audit logs.6

For an account synchronized from Active Directory, Microsoft’s compromised-account guidance says to reset the password in Active Directory twice to mitigate pass-the-hash risk.6

Installing the fixed build closes this vulnerability, but it does not by itself establish that a previously disclosed credential was not used.126

FAQ

Is viewing the message in Preview Pane enough to trigger this issue?

No. Microsoft says the Preview Pane is not an attack vector, but opening a crafted message file is the required user interaction.1

Does CISA’s KEV listing mean ransomware is confirmed?

No. Microsoft lists exploitation as detected, while CISA’s ransomware field is Unknown; those statements answer different questions.14

Can every Microsoft 365 device use the Current Channel build as its verification target?

Use the Current Channel build only for devices actually on Current Channel; other Microsoft 365 channels have different fixed builds in the same release table.2

What if someone already opened a suspicious message file?

If a suspicious file was opened, update the device and escalate for credential-focused investigation rather than assuming the update alone resolves past exposure.136

Sources

  1. Microsoft Security Response Center: CVE-2026-124194 (retrieved 2026-11-10T22:54:18Z)
  2. Microsoft Office security update release notes (retrieved 2026-11-10T22:54:18Z)
  3. Microsoft Support: How to update Microsoft 365 or Office for Windows (retrieved 2026-11-10T22:54:18Z)
  4. CISA Known Exploited Vulnerabilities catalog (retrieved 2026-11-10T22:54:18Z)
  5. Microsoft: Network security—Restrict NTLM outgoing traffic (retrieved 2026-11-10T22:54:18Z)
  6. Microsoft: Respond to a compromised email account (retrieved 2026-11-10T22:54:18Z)
  7. Microsoft: EventLogService retention policy (retrieved 2026-11-10T22:54:18Z)

Browse Articles

Latest Articles