Newshot CISA Confirms Outlook 0-Day Exploited in the Wild, Can Leak User Authentication Data
Specially Crafted Message Files Can Trigger the Flaw and Leak NTLMv2 Authentication Hashes
CISA has confirmed a 0-day vulnerability in Microsoft Outlook, tracked as CVE-2026-124194, that is already being exploited in the wild. Attackers can use the flaw to steal users' authentication data.
According to the security advisory published by Microsoft, an attacker can send a specially crafted message file and trick a victim into opening it in Outlook. In this case, Outlook does not display the usual external content warning and instead connects directly to a network address controlled by the attacker.
The connection leaks the victim's NTLMv2 hash, and attackers can use this kind of authentication data to impersonate the user. Microsoft classifies the flaw as a spoofing vulnerability rather than a remote code execution vulnerability. It assesses that the vulnerability has a serious impact on confidentiality but does not directly affect data integrity or service availability.
The vulnerability has a CVSS score of 6.5, and an unauthenticated attacker can exploit it to conduct network spoofing. Microsoft has released a security update for the flaw.
The vulnerability falls under CWE-356, a category of defects whose core characteristic is that software performs a potentially dangerous operation without explicit user permission. In this case, the missing warning before Outlook connects to an external network address amounts to bypassing a security check mechanism.
The Flaw Is Not a 0-Click Attack and Cannot Be Triggered via the Preview Pane
Notably, the absence of a user interaction prompt at the connection stage does not mean this is a 0-click attack. Microsoft explicitly states that a victim must manually open the malicious file to trigger the flaw, and the Outlook preview pane is not an attack vector for this vulnerability. This characteristic can help defenders distinguish it from earlier Outlook vulnerabilities that required no user action.
Cyber Security News previously reported on Russian hackers exploiting CVE-2023-23397 against Outlook, as well as CISA's warning about the MonikerLink vulnerability. These reports can serve as background reference for Outlook vulnerability exploitation, but the attack methods described in them cannot be directly applied to this new vulnerability.
CISA Adds the Flaw to Its KEV Catalog and Sets a Deadline for Remediation
Affected products include the 32-bit and 64-bit versions of Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The fixed version for Office LTSC 2021 is 16.0.14334.21048, and the fixed version for Office LTSC 2024 is 16.0.17932.21140. Microsoft 365 administrators can refer to the Office security release guidance linked in the advisory to determine the correct update version for their deployment environment.
CISA added the vulnerability to its KEV catalog on November 10, 2026, requiring agencies to complete remediation by November 24. Agencies need to implement the mitigations provided by the vendor and inventory their internet-exposed assets. If no fix is available, they should immediately stop using the affected products.
Administrators should audit all affected Office installations and deploy the corresponding patches. After remediation, they need to verify the actually installed version number rather than relying solely on update deployment reports to judge the result. When prioritizing patches, teams must not overlook the fact that the vulnerability is already being exploited in the wild just because it is rated as a medium-severity flaw.
Microsoft has detected exploitation activity targeting the vulnerability, but the published advisory does not disclose the attackers' identity, the scope of victims, the scale of the campaign, or IOCs. These information gaps should be clearly communicated to the relevant parties and must not be filled in with details from past Outlook attacks.
CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability