Exploited Outlook Zero-Day: Patch Now and Stop NTLM Leaks

Microsoft has patched an Outlook zero-day that attackers were already using. Opening one booby-trapped message file can quietly hand over a staff member’s Windows password hash, with no warning on screen.

November’s Patch Tuesday fixed CVE-2026-124194, a spoofing flaw in Outlook. Microsoft rates it moderate (CVSS 6.5) but confirms it was exploited before a fix existed. An attacker sends a crafted message file. If someone opens it, Outlook connects to an attacker-controlled location without the usual external content warning and discloses the user’s NTLMv2 hash. It affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, and the Preview Pane does not trigger it, according to SecurityWeek.

Why a moderate rating is not a reason to wait

Our view: the score undersells the risk. A stolen hash can be used to sign in as that person, and in a small business that person is often the finance officer or the office manager with access to everything. The patch closes this particular door, but the lasting fix is making sure Windows credentials cannot leave your network in the first place. Laptops that roam between the office, home and cafe Wi-Fi are usually where that protection is missing.

What to do today

• Update Office now. Confirm Microsoft 365 Apps and Office LTSC machines have the November build. Click-to-Run updates can lag, so force a check rather than waiting.
• Block outbound SMB. Your firewall should stop TCP port 445 leaving the network. Check that laptops off the office network are covered too, for example with a managed endpoint firewall policy.
• Tell your team. Staff should not open unexpected message files (.msg) from outside the business, even from a name they recognise. Report them instead.
• Reduce NTLM exposure. Audit where NTLM is still in use, move to Kerberos where you can, and require MFA with Conditional Access so a stolen hash is worth less.