The Outlook Zero-Day That Skips the Warning

Most people have seen the bar in Outlook saying some content has been blocked, or the prompt asking whether it is safe to connect to an outside location. Those warnings are easy to dismiss as clutter, but they do a job. On 10 November 2026 Microsoft patched an Outlook flaw, tracked as CVE-2026-124194, that let a crafted file skip that warning altogether and quietly hand an attacker part of the user's sign-in credentials. Microsoft says it has been exploited in the wild.

The flaw carries a "Moderate" rating and a CVSS score of 6.5, which is easy to scroll past in a month when Microsoft fixed well over a thousand vulnerabilities. It deserves more attention than the label suggests, because the only thing standing between the attacker and the outcome is one person opening one file.

What has Microsoft confirmed?

According to Microsoft's Security Update Guide entry, as reported by SecurityWeek and Tenable, CVE-2026-124194 is a spoofing vulnerability in which Outlook does not warn users of unsafe actions. An unauthenticated attacker has to "convince a user to open it in an affected version of Microsoft Outlook". Once the file is opened, Outlook connects to a network location the attacker controls, without showing the usual external-content warning.

Microsoft's description of the impact is blunt: "This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user."

The advisory also confirms the following:

• Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
• Microsoft says the flaw "cannot be triggered through the Preview Pane". The file has to be opened.
• Microsoft is aware of active exploitation but has not published details of the attacks or attributed them to any group.
• The flaw was not publicly disclosed before the fix was released.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog, with federal agencies told to patch by 24 November 2026, The Hacker News reports. Microsoft credits the discovery to a researcher using the handle "nono" and to Benoît Sevens, whose acknowledgement mentions Anthropic's Claude AI model.

What is an NTLMv2 hash, and why does it matter?

NTLM is an older Windows authentication protocol that is still widely used inside organisations. When a Windows machine authenticates to a server using NTLM, it does not send the password itself. It sends a response calculated from the password and a one-time challenge from the server. That response is what security teams call the NTLMv2 hash.

So no password travels in plain text, and nothing in Microsoft's advisory says passwords were leaked. The risk lies in what an attacker can do with the hash once they hold it. There are two common routes. The first is relaying, where the attacker passes the authentication on to another service in real time and ends up signed in as the victim. The second is offline cracking, where the attacker tries vast numbers of password guesses against the captured hash until one fits, which works far better against short or reused passwords. Microsoft's own wording, that the attacker "could use this to authenticate as the user", is why a Moderate rating can still lead somewhere serious.

Haven't we seen this before?

Outlook and NTLM have history. In March 2023 Microsoft patched CVE-2023-23397, an Outlook flaw that also leaked Net-NTLMv2 hashes to an attacker-controlled server. That one was worse in an important respect. According to the Canadian Centre for Cyber Security, "exploitation can occur prior to the email being opened or previewed by the user." No click was needed at all.

CVE-2026-124194 needs a person to open a file, which is a meaningful difference. It also means the attacker has to persuade someone, and that puts it squarely in phishing territory. This fits the wider picture. In Cisco Talos's incident response trends for Q3 2026, phishing was still the most common way attackers got in, seen in 37% of engagements.

Why does a missing warning matter so much?

Security awareness training teaches people to slow down when software tells them something is unusual. Warnings and prompts are part of how people make good decisions under time pressure. This flaw takes one of them away. From the user's point of view, they opened an attachment and nothing visibly strange happened.

That is the lesson for anyone designing a security programme. People cannot react to a signal they never see. A sensible strategy treats the person as one layer among several and makes sure the other layers still work when one of them fails. Here, the layers that matter most are prompt patching, tight controls on NTLM and outbound network traffic, and a culture where an unexpected attachment gets reported before anyone opens it.

What might an attack look like?

Microsoft has not described the lures used in the real attacks, so treat this as an illustration rather than a report. A finance assistant receives an email that appears to come from a supplier, with a file attached and a note saying updated remittance details are inside. They open it in Outlook. Something appears on screen, perhaps a few lines of ordinary text. Behind the scenes, Outlook has already reached out to a server on the internet and offered up the assistant's NTLMv2 hash. Nothing prompted them and nothing looked wrong. The first sign of trouble might be a sign-in from somewhere unexpected, days later.

What should organisations do?

• Patch Outlook now. Apply Microsoft's November 2026 updates to Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, and confirm that clients have actually updated rather than assuming they have.
• Block outbound SMB to the internet. Blocking TCP port 445 at the perimeter was a core recommendation for CVE-2023-23397 and limits forced-authentication attacks generally. Microsoft has not said which protocol this flaw uses, so treat it as sound hardening, not a guaranteed fix.
• Reduce reliance on NTLM. Microsoft lists NTLM as deprecated in Windows. Adding high-value accounts to the Protected Users security group, which blocks NTLM for those accounts, and restricting outgoing NTLM traffic to remote servers both shrink what a stolen hash is worth.
• Make relaying harder. SMB signing and Extended Protection for Authentication on services that still accept NTLM make it much harder to reuse a captured hash in real time.
• Enforce strong, unique passwords. A captured hash is only useful for offline cracking if the password behind it can be guessed.
• Watch for odd authentication. Alert on Outlook connecting to unfamiliar internet hosts and on NTLM sign-ins that do not fit a user's normal pattern.
• Make reporting easy. Give staff a one-click way to report unexpected attachments, and thank them when they do, even when the email turns out to be harmless.

What should individuals do?

Be careful with attachments you were not expecting, even from names you recognise, and particularly with Outlook message files and Office documents. If something arrives out of the blue, check with the sender using contact details you already have before opening it. If you have already opened something that now feels off, report it straight away. An early report gives the security team time to reset credentials and look for misuse before an attacker gets far.

The bottom line

CVE-2026-124194 is a reminder that a "Moderate" label describes the technical severity of a bug, not the business impact of a stolen identity. The fix is available and should go on quickly. Beyond the patch, the lasting lesson is about layers. When software stops warning people, the rest of your defences have to carry more of the weight, and staff need to feel confident reporting anything that seems off.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.