🔍 Read the full analysis: Outlook Zero-Day Patch Plan: Prepare For CISA’s November 24 Deadline on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft says attackers are exploiting an Outlook vulnerability that can expose a user’s NTLMv2 hash when the user opens a crafted file. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10 and set a November 24 deadline for U.S. federal civilian agencies; Microsoft has released updates and lists no workaround.
CISA has given U.S. federal civilian agencies until November 24 to address an actively exploited vulnerability in Microsoft Outlook, after adding it to the agency’s Known Exploited Vulnerabilities catalog on November 10. Microsoft has released security updates for affected Office products and lists no workaround for CVE-2026-124194.
Microsoft identifies the issue as the Microsoft Outlook Spoofing Vulnerability and marks it “Exploited: Yes.” The company says an unauthenticated attacker can send a specially crafted Office file and try to persuade a user to open it. In an affected Outlook version, that action can cause the application to connect to a server controlled by the attacker without showing the usual external-content warning.
Microsoft says the connection can disclose the user’s NTLMv2 hash, which an attacker “could use to authenticate as the user.” The attack requires a person to open the file, according to Microsoft; the company says the Preview Pane is not an attack vector. The vulnerability does not itself provide code execution, and Microsoft rates it Moderate, with a CVSS score of 6.5 out of 10.
The affected products listed in the source material are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Microsoft’s fixed builds include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps users should check the November 10 security release for the fixed build applicable to their update channel. The source material lists several channel builds, but its list ends before giving all of them.
Outlook Zero-Day Patch Plan Meet the November 24 deadline
Attackers are exploiting an Outlook flaw that may expose a user’s NTLMv2 hash when they open a crafted file. Microsoft has issued updates; CISA set a remediation deadline for federal civilian agencies.
Who must act by the deadline?
CISA’s binding directive applies to federal civilian executive branch agencies.
- Apply the vendor update by November 24, 2026.
- Verify the installed build on managed devices.
- The directive’s deadline does not apply to them.
- CISA encourages prioritizing KEV-listed vulnerabilities.
How the flaw can expose credentials
Microsoft says a user must open the crafted file; the Preview Pane is not an attack vector.
An attacker tries to persuade a user to open a specially crafted Office file in affected Outlook.
The application may connect to an attacker-controlled server without the usual external-content warning.
Microsoft says the NTLMv2 hash could be used to authenticate as the user.
Deploy and verify the fix
Match each installation to the update for its product and, for Microsoft 365 Apps, its update channel.
| Product | Fixed build or action |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check Microsoft’s November 10 release for the build for your update channel |
Why the Outlook Fix Has a Deadline
The flaw’s significance comes from confirmed exploitation and the possibility of stolen authentication material, not from a claim that it can automatically take over a computer. An exposed NTLMv2 hash could, Microsoft says, be used to authenticate as the affected user. That may create further risk for organizations whose systems rely on those credentials, although the source material does not establish that attackers have used the flaw to move through networks.
The November 24 date is a binding deadline for federal civilian executive branch agencies under CISA’s directive, not a general legal deadline for every business or individual. CISA nevertheless encourages all organizations to prioritize vulnerabilities in its KEV catalog. For other Outlook users, the active-exploitation listing is a strong reason to apply the relevant update promptly, while recognizing that CISA’s directive does not apply to them.
Microsoft rates the vulnerability as moderate and says user action is required. Those details qualify the risk, but do not negate the need to patch: the attack is already being used, and the product lacks a listed workaround. IT teams should verify the installed Office build rather than rely only on deployment policies or assumptions about whether updates have reached every device.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
DJI Mini 5 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
How CISA Set the November Deadline
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, citing evidence of active exploitation. The same day, the agency added five other vulnerabilities affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium, according to the supplied source. The Outlook entry names the issue as a failure to provide user interaction for a potentially unsafe action.
The catalog entry gives agencies a due date of November 24 and directs them to apply mitigations according to vendor instructions, or discontinue use of a product if mitigations are unavailable. In this case, Microsoft has issued updates. CISA says its binding directive, BOD 26-04, applies only to federal civilian executive branch agencies, while encouraging other organizations to use risk-based vulnerability management and prioritize KEV-listed flaws.
The source says Microsoft’s November release marked this as the only flaw with “Exploitation Detected.” It also reports that CISA’s record lists ransomware use as unknown and does not mark the vulnerability for forensic triage. Those catalog fields do not establish whether a particular organization has been attacked.
““An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.””
— Microsoft, as quoted in its security entry
What the Exploitation Reports Do Not Say
The available source material does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. It also does not establish whether stolen hashes have been used to access accounts or systems. CISA’s catalog lists ransomware use as unknown, so the flaw should not be described as confirmed to be part of ransomware campaigns.
The source provides only part of Microsoft 365 Apps’ channel-by-channel fixed-build list. Administrators should consult Microsoft’s current security update information for the build tied to their specific channel and verify that installation succeeded. The cited details also do not establish whether every affected device in an organization has received the patch.
Patch Verification Before November 24
Federal civilian agencies must meet CISA’s November 24, 2026 deadline by applying the vendor update or following the catalog’s direction to discontinue use if mitigation is unavailable. Because Microsoft has shipped a fix, administrators should identify affected Outlook installations, deploy the applicable Office update, and confirm the installed build on managed devices.
Organizations outside the federal civilian branch are not bound by this deadline under the directive, but CISA recommends prioritizing KEV vulnerabilities. Users and IT teams should use Microsoft’s release information to match their product and Microsoft 365 Apps channel to the correct fixed build. Further information about targets, attack timing and the scope of exploitation was not provided in the source material.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook vulnerability that Microsoft calls a spoofing flaw. A crafted file opened in an affected Outlook version can trigger a connection to an attacker-controlled server without the usual warning and may disclose the user’s NTLMv2 hash.
Who must meet the November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s directive. CISA encourages other organizations to prioritize the flaw, but the supplied material does not make the date binding on them.
Does opening the Preview Pane trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says an attacker must persuade a user to open the crafted file.
Is there a workaround?
No workaround is listed in Microsoft’s entry. The supplied source says the Office security update is the fix, with builds varying by product and Microsoft 365 Apps update channel.
What is not known about the attacks?
The source material does not identify the attackers, targets, number of affected users or organizations, or when exploitation began. It also says ransomware use is unknown.
Source: ThorstenMeyerAI.com
