Loading vulnerability…
NTLMv2 Credential Disclosure in Microsoft Outlook
CVE-2026-124194 is a spoofing vulnerability in classic Microsoft Outlook caused by failure to warn users before performing an unsafe action. When a user opens a specially crafted message file, affected Outlook installations can connect to an attacker-controlled network resource without displaying the usual external-content warning. Automatic Windows NTLM authentication can then expose the user's NTLMv2 challenge-response material. Exploitation requires user interaction and network connectivity; the Outlook Preview Pane is not an attack vector. Affected products include 32-bit and x64 editions of Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft rates the vulnerability Moderate, with a CVSS v3.1 score of 6.5, and confirmed active exploitation. Microsoft released security updates on November 10, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes NTLMv2 authentication material, creating a high confidentiality impact. Attackers may attempt offline password cracking or relay an authentication exchange to services that accept NTLM and lack appropriate anti-relay protections. Subsequent impersonation can enable unauthorized access to resources available to the victim and potentially lateral movement. Captured challenge-response material is neither a plaintext password nor the underlying reusable NT password hash, and capture alone does not guarantee account compromise. Downstream impact depends on password strength, service configuration, and authentication protections. The vulnerability does not directly provide remote code execution or direct integrity or availability impact.
If you can’t patch tonight, do this now.
No explicit vendor workaround is identified. Until patched, avoid opening unexpected or untrusted Outlook message files and templates. Block unnecessary internet-bound SMB traffic, particularly TCP port 445, and audit then restrict outbound NTLM authentication while accommodating legitimate dependencies. Require SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication on applicable services to reduce relay opportunities. Consider Protected Users membership for compatible privileged accounts. These controls reduce exposure or downstream abuse but do not replace the Outlook update.
Patch, then assume compromise.
Install the applicable November 2026 or later Office security update on affected Outlook installations. Update Office LTSC 2021 to build 16.0.14334.21048 or later and Office LTSC 2024 to build 16.0.17932.21140 or later. For Microsoft 365 Apps for Enterprise, deploy the corrected security build for the installation's servicing channel. Verify installed Office builds independently of Windows patch compliance: a Windows cumulative update alone does not remediate this vulnerability. If credential exposure is suspected, investigate affected identities and subsequent authentication activity; reset affected passwords and revoke relevant sessions when exposure or abuse is established. Patching does not invalidate previously captured authentication material.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
154 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.