Microsoft has patched an Outlook vulnerability that has already been exploited in attacks and can expose NTLMv2 authentication information when a victim opens a specially crafted message file. Tracked as CVE-2026-124194, the issue was included in the company’s November 10, 2026 security updates.
Opening the malicious file can cause Outlook to contact an attacker-controlled server without the usual warning for external content, potentially sending NTLMv2 authentication data that could later be used in attempts to compromise an account. Simply previewing the file in Outlook’s Reading Pane does not trigger the vulnerability.
Microsoft classifies the flaw as a spoofing vulnerability with a moderate CVSS score of 6.5. Its active exploitation makes installing the update more urgent, particularly for users who receive unexpected message files, even when the apparent sender looks familiar.
Microsoft credits researcher “nono” and Benoît Sevens for reporting the issue. Sevens used Claude, Anthropic’s AI assistant, during the discovery process.
The affected Office product lines include:
- Microsoft 365 Apps for enterprise
- Office LTSC 2021, fixed in version 16.0.14334.21048
- Office LTSC 2024, fixed in version 16.0.17932.21140
The Outlook fix arrived in an unusually large Microsoft security release. KrebsOnSecurity counted 1,093 vulnerabilities addressed in November, including 63 rated critical, and reported that Microsoft linked the rising volume of discovered issues in part to AI-assisted vulnerability research and remediation. Managed Office installations may receive the update on an IT-controlled schedule, making deployment status the key remaining factor for affected organizations.
