CVE-2026-124194 is a Microsoft Outlook flaw that Microsoft published on 10 November 2026 and CISA added to its Known Exploited Vulnerabilities catalogue the same day, with a required action date of 24 November 2026. It is already being exploited.
The detail that catches people out: it is fixed by an Office update, not by the Windows cumulative update. Anyone who installed November’s Windows patches and closed the ticket is still exposed.
CISA lists CVE-2026-124194 as “Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability”, added to the Known Exploited Vulnerabilities catalogue on 10 November 2026 with a required action date of 24 November 2026.
What CVE-2026-124194 Actually Is
Microsoft describes it in its own CVE record as a spoofing vulnerability: “Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.” The weakness class is CWE-356, where a product interface fails to warn the user before an unsafe action.
In practice that means opening a crafted message file in desktop Outlook can trigger something the user was never asked to approve. Researchers reporting on CVE-2026-124194 describe the consequence as the client leaking the user’s NTLMv2 authentication hash, which an attacker can then relay or attempt to crack. That mechanism comes from independent analysis rather than from Microsoft, whose own description stops at spoofing, so treat it as well reported rather than vendor confirmed.
The score is lower than the attention suggests. Microsoft rates it CVSS 6.5, severity Medium. The vector repays reading properly: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C. Network reachable, low complexity, no privileges needed, user interaction required, high impact on confidentiality and none on integrity or availability. The last three segments are the ones that should change your week: exploit maturity High, an official fix available, report confidence Confirmed.
Why a Medium Score Still Means Act This Week
Because severity and urgency answer different questions. A 6.5 being used in the wild is a bigger problem than a 9.8 nobody has weaponised, and the vector says this one is in use: exploit maturity High, report confidence Confirmed.
CISA’s catalogue is the clearer signal. Inclusion means confirmed active exploitation, and the entry carries a required action date of 24 November 2026. That date binds US federal civilian agencies rather than UK businesses, but it is the most useful external deadline available, and insurers and auditors increasingly treat the catalogue as the baseline for what should already have been patched.
There is a second reason to move. Credential-leak flaws do not announce themselves. No crash, no ransom note, no obvious symptom. If a hash leaves your estate, the first sign is usually a successful login from somewhere that does not fit, which is why detection matters here as much as patching.
Need this patched across the estate?
Talk to the Transputec team about the security work behind our Managed SOC and Managed Detection and Response.
Get in TouchWhich Versions Are Affected, and What Fixes Them
Microsoft’s own CVE record lists three affected products, on both 32-bit and 64-bit systems. The fixed build differs by product, and one of them deliberately has no single number.
| Product | Fixed from |
|---|---|
| Microsoft 365 Apps for Enterprise | Depends on your update channel. Microsoft points to its Office security releases list rather than naming one build |
| Microsoft Office LTSC 2021 | 16.0.14334.21048 |
| Microsoft Office LTSC 2024 | 16.0.17932.21140 |
The first row is where most organisations sit, and it is the row that causes the confusion. Microsoft 365 Apps has no single fixed build for CVE-2026-124194, because Current Channel, Monthly Enterprise Channel and the Semi-Annual channels ship on different dates. The build you need is the one for the channel you are on, which is why quoting one version number across a whole estate is unsafe.
Second-hand build numbers for the Current Channel are circulating and they do not appear in Microsoft’s record, so check your channel against Microsoft’s Office security releases page rather than against a blog post, this one included.
Why the Windows Cumulative Update Does Not Fix This
Because it is an Office vulnerability, not a Windows one. Every product on Microsoft’s affected list is an Office product, and Office patches itself through its own update channel rather than through the Windows cumulative update.
This is the gap that will catch organisations out. November’s Patch Tuesday was enormous, and the standard response to an enormous Patch Tuesday is to push the Windows updates, confirm the estate reports compliant and close the ticket. Doing exactly that leaves CVE-2026-124194 unpatched, because nothing in the Windows cumulative update moves Outlook’s build.
If patching runs through a managed service, ask specifically whether Office channel updates are in scope or whether the service covers operating system patching only. The distinction rarely comes up until a flaw like this one lands. What a complete service should cover is set out in our guide to managed server patching.
What Microsoft Has Not Published
A workaround. Microsoft’s CVE record for CVE-2026-124194 carries no workarounds section, no mitigations and no configuration guidance. The only remediation offered is the update, which matches the vector’s remediation level of Official fix.
That matters, because network hardening steps are circulating as though they were vendor guidance. They are not. The measures commonly suggested are blocking outbound TCP 445 and 139 at the perimeter, stopping the WebClient service where WebDAV is not in use, and restricting outgoing NTLM where applications tolerate it. Those are reasonable practitioner recommendations for reducing NTLM exposure in general, and several are sound hygiene whatever happens with this flaw.
They are not a substitute for the update, and none of them is Microsoft’s published mitigation. If you apply them, apply them as defence in depth while the Office update rolls out, and record them as your own decision rather than as vendor instruction.
How to Check Whether You Are Already Patched
On one machine, open Outlook and go to File, then Account, then About Outlook. That gives you the build and the channel. Compare both against Microsoft’s Office security releases list for 10 November 2026 or later.
Across an estate, one machine tells you very little. What you want is the distribution: how many devices sit on each channel, which build each is running, and how many are behind. Most organisations find at this point that a meaningful share of devices have not completed an Office update in weeks, usually because nobody closed the application.
- Group by channel first. A single target build is meaningless if half the estate is on Monthly Enterprise and half on Current.
- Count the laptops that are rarely restarted. Office updates apply on restart, so uptime is a reasonable proxy for exposure.
- Look at desktop Outlook specifically. Microsoft’s affected list names Office desktop products, so that is where to check.
- Record the date you verified it. If an auditor or insurer asks about CVE-2026-124194 in three months, the useful answer has a timestamp against it.
What to Do If You Think a Hash Has Already Leaked
Treat it as a credential incident rather than a patching one. The update stops further leakage. It does nothing about a hash that has already left.
The practical sequence is to establish who opened what, reset credentials for any account that may have been exposed, and then look for the thing that actually matters: a successful authentication with those credentials from somewhere that does not fit. Relay and cracking both end in a normal-looking login, so this shows up in sign-in logs rather than in endpoint alerts.
This is the part organisations are least equipped for, because it needs somebody watching outside working hours and the authority to disable an account without waiting for a change board. That is the ground our Managed Detection and Response and Cyber Incident Response services cover, the latter running to NIST and ISO/IEC 27035.
Where This Sits in a Thousand-CVE Patch Round
November’s release was unusually large. Reporting on the 10 November round puts it at roughly 1,094 CVEs with 63 rated critical, and one tally that folds in Chromium-based Edge flaws goes as high as 1,235. The counts differ because outlets treat Edge differently.
A number that size is not a patching plan, and treating it as one is exactly how a moderate-scored Outlook flaw disappears behind 63 critical entries. The ordering that actually reduces risk is narrower than the severity column suggests.
- Anything in CISA’s catalogue goes first, whatever its CVSS score, because inclusion means it is being used now.
- Then critical flaws reachable from the internet, because those need nobody to click anything.
- Then everything else by severity, on your normal cycle.
On that ordering this Outlook flaw lands in the first group despite its 6.5, and most of the 63 critical entries land in the second. That inversion is the point. The catalogue describes what attackers are doing. The CVSS score describes what could theoretically happen.
How Transputec Approaches a Live Exploited CVE
Two things decide whether a flaw like this becomes an incident: how fast the fix reaches the estate, and whether anybody would notice if it arrived too late.
Transputec covers both from a UK SOC. Our cyber security services run to six: Managed SOC, ThreatSpike SOC, Penetration Testing, Microsoft Sentinel SOC, Vulnerability Management and Managed Detection and Response. On MDR the published position is containment authority from day one, which is what lets a suspect account be disabled while disabling it still helps.
For CVE-2026-124194 the work is unglamorous. Establish which update channel every device is on, get the Office build moved, then watch the sign-in logs for the authentication that should not be there. Talk to our team about the security work behind our Managed SOC if you would rather that ran as a service than as a scramble.
Frequently Asked Questions
What is CVE-2026-124194?
A Microsoft Outlook vulnerability published on 10 November 2026. Microsoft classes it as spoofing, under CWE-356, where the interface fails to warn the user before an unsafe action, and scores it CVSS 6.5 Medium. Independent researchers report that the practical consequence is the client leaking the user’s NTLMv2 authentication hash, which an attacker can relay or try to crack. CISA added it to the Known Exploited Vulnerabilities catalogue the same day it was published.
Is the Outlook zero-day actually being exploited?
Yes. Two independent signals say so. The CVSS vector Microsoft published carries an exploit maturity of High and a report confidence of Confirmed, and CISA only adds entries to its Known Exploited Vulnerabilities catalogue where exploitation is confirmed. The catalogue entry has a required action date of 24 November 2026.
Does the Windows cumulative update fix it?
No. Every product on Microsoft’s affected list is an Office product, and Office updates arrive through their own channel rather than through the Windows cumulative update. Installing November’s Windows patches leaves this one open. The fix has to come through Microsoft 365 Apps or the relevant Office LTSC update.
Which Outlook and Office versions are affected?
Microsoft’s record names Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024, on both 32-bit and 64-bit systems. LTSC 2021 is fixed from build 16.0.14334.21048 and LTSC 2024 from 16.0.17932.21140. Microsoft 365 Apps has no single fixed build because it depends on your update channel, so check your channel against Microsoft’s Office security releases list.
What should we do if a user already opened a suspicious message file?
Treat it as a credential incident, not a patching one. Reset the credentials for any account that may have been exposed, then search the sign-in logs for a successful authentication from an unexpected location or device, because that is how a relayed or cracked hash shows up. Patching stops further leakage but does nothing about a hash that has already gone.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
