Microsoft Patches Outlook Flaw Cited in Active Attacks

Microsoft included a fix for Outlook vulnerability CVE-2026-124194 in the security updates it released on November 10, 2026. The company’s advisory classifies the flaw as spoofing and states that attackers were actively exploiting it.

Network access and user interaction are both required for exploitation, according to Microsoft’s advisory as summarized by BleepingComputer. A user must open a specially prepared message file. Outlook may then contact a network destination controlled by an attacker without displaying the warning it normally provides for external content. That connection could expose authentication information, according to the advisory.

BleepingComputer reported that the attacks targeted NTLM hashes associated with users’ accounts. Its explanation of the disclosure mechanism describes how Windows can automatically transmit an NTLMv2 authentication hash when connecting to a network share controlled by an attacker.

According to that explanation, an attacker who obtains the hash could try to crack it offline. This describes a possible use of captured authentication data, rather than establishing that every exploitation attempt results in successful disclosure or cracking.

* This article is based on publicly available information at the time of writing.