Microsoft confirms hackers exploiting Outlook zero-day to steal Windows authentication hashes

Article title: Microsoft Confirms Hackers Are Exploiting an Outlook 0-Day to Steal Windows Authentication Hashes

Body:

Microsoft has confirmed that hackers are exploiting an Outlook 0-day vulnerability to launch attacks. When a user opens a malicious file, the vulnerability can cause Windows authentication information to be leaked.

The vulnerability is tracked as CVE-2026-124194 and is a spoofing vulnerability. Microsoft released a patch on November 10, 2026. Microsoft marked it as "Exploitation Detected," and stated that the vulnerability had not been publicly disclosed before the patch was released.

The vulnerability has a CVSS score of 6.5, rated Medium severity. However, because real-world attacks have already occurred, users should prioritize patching it. Microsoft's Exploitability Index makes clear that "Exploitation Detected" means the company has actual in-the-wild attack cases in hand, rather than merely the risk level of "an attacker could develop working exploit code."

Triggering the Vulnerability Requires User Interaction; Successful Exploitation Can Leak NTLMv2 Hashes

The attacker does not need to obtain an account on the target system, nor does the attacker need prior access to the target system. The attacker only needs to send a specially crafted message file and trick the recipient into opening it in an affected version of Outlook. Successful exploitation requires two conditions to be met at the same time: the user performs the open action, and the device is connected to the network.

When the user opens the malicious file, Outlook connects directly to a network location controlled by the attacker, without displaying the usual external content security warning. Microsoft classifies the root flaw of this vulnerability as CWE-356, meaning the product UI fails to warn users about high-risk operations; the missing warning deprives users of a key line of defense for blocking the malicious connection.

Microsoft explicitly states that the preview pane is not an attack vector. Viewing a message only in the preview pane does not meet the trigger conditions for exploitation. This characteristic distinguishes this vulnerability from the Outlook vulnerability previously exploited by Russian hackers—Cybersecuritynews.com reported on that wave of attacks, which involved a different class of vulnerability that could be triggered without user action.

According to Microsoft's security advisory, successful exploitation of the vulnerability leaks the user's NTLMv2 hash, which an attacker could use to impersonate the user and complete authentication. It should be clear that the vulnerability can only steal authentication data and cannot directly run malicious code on the target device. Microsoft rates the vulnerability's confidentiality impact as High, with no direct impact on integrity or availability.

NTLM information leakage can be used for follow-on attacks, with the specific attack outcome depending on the protection configuration of the receiving service. Microsoft's earlier Outlook security research showed that after obtaining Net-NTLMv2 data, attackers can typically carry out follow-on operations such as authentication relaying and offline password cracking.

Cybersecuritynews.com previously reported that attackers had used compromised Ubiquiti routers to steal user credentials through external infrastructure. However, these historical attack campaigns are unrelated to attribution of this new attack and cannot be used to determine who launched it.

Multiple Office Versions Affected; Security Patches Should Be Deployed Promptly

Affected products include the 32-bit and 64-bit versions of Microsoft 365 Apps for enterprise, Office LTSC 2021, and Office LTSC 2024. The corresponding fixed versions published by Microsoft are: 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Administrators should deploy the corresponding security updates for affected products in their environments as soon as possible.

As an additional mitigation, Microsoft recommends blocking unnecessary outbound SMB traffic on TCP port 445 to the internet. This measure can reduce the risk of devices being exposed to the external SMB attack surface, but it cannot replace installing the Outlook vulnerability patch.

Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes