Vulnerability
CVE-2026-124194 Deep Dive: Microsoft Outlook Zero-Day Exposes NTLMv2 Hashes in Active Attacks and How to Defend Your Domain
On November 10, 2026, CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities Catalog following confirmed in-the-wild zero-day attacks against Microsoft Outlook. The flaw bypasses user interaction warnings to force outbound NTLM authentication, exposing domain credential hashes. We examine the NTLM relay exploit mechanics, evaluate affected Office versions, and deliver an enterprise hardening playbook with firewall rules and Group Policy controls.
13 min read
CVE-2026-124194 Deep Dive: Microsoft Outlook Zero-Day Exposes NTLMv2 Hashes in Active Attacks and How to Defend Your Domain
Executive Summary
On November 10, 2026, Microsoft released its monthly Patch Tuesday security updates, resolving over 1,000 vulnerabilities across its product ecosystem. Standing out as the sole confirmed zero-day under active in-the-wild exploitation is CVE-2026-124194, a high-risk security flaw in Microsoft Outlook for Windows. The vulnerability was immediately cataloged by the Cybersecurity and Infrastructure Security Agency (CISA) in its Known Exploited Vulnerabilities (KEV) Catalog on the same day, establishing a mandatory federal remediation deadline of November 24, 2026, pursuant to Binding Operational Directive (BOD) 22-01.
Discovered and credited to security researchers Benoit Sevens (using Claude with Anthropic) and nono, CVE-2026-124194 is formally classified by Microsoft as a "Microsoft Outlook Spoofing Vulnerability" with a Common Vulnerability Scoring System (CVSS v3.1) Base Score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The vulnerability belongs to Common Weakness Enumeration CWE-356 ("Improper Input Validation / Missing User Interaction for Potentially Unsafe Action").
Despite its nominal "Moderate" severity rating, threat intelligence researchers and enterprise security practitioners consider the real-world operational risk critical. The vulnerability allows an unauthenticated remote attacker to craft a malicious email message file (.msg or embedded MIME part) that, upon previewing or opening in Microsoft Outlook, forces the underlying Windows operating system to initiate an unprompted, outbound network authentication request (over Server Message Block, SMB port 445, or WebDAV ports 80/443) to an attacker-controlled external server. Crucially, Outlook fails to render the standard security dialog warning the user of external network content.
During this outbound negotiation, the Windows client automatically transmits the victim's NTLMv2 authentication hash. Threat actors capturing this hash can either crack it offline to recover cleartext Active Directory domain passwords or execute real-time NTLM Relay attacks against corporate services—including Active Directory Certificate Services (AD CS), unauthenticated LDAP endpoints, or SMB signing-disabled servers—achieving unauthorized lateral movement and full domain compromise.
This deep dive deconstructs the microarchitecture and protocol mechanics of CVE-2026-124194. We analyze the missing user interaction boundary in Outlook's message parsing engine, dissect the NTLM challenge-response authentication handshake, evaluate real-world threat vectors and relay topologies, and provide an enterprise defensive playbook spanning perimeter firewall blocks, Windows Group Policy NTLM restrictions, and Kusto Query Language (KQL) threat hunting rules.
+----------------------------------------------------------------------------------------------------+
| CVE-2026-124194 Exploit Mechanics and Relay Attack Topology |
+----------------------------------------------------------------------------------------------------+
| |
| [ Threat Actor / Remote Attacker ] |
| | |
| v (Sends crafted email with embedded UNC path \\attacker.com\share\payload) |
| +----------------------------------------------------------------------------------------------+ |
| | TARGET ENTERPRISE WORKSTATION (Windows 11 / 10 + Outlook Client) | |
| | | |
| | Microsoft Outlook | |
| | | | |
| | v (User previews or opens message) | |
| | Missing User Interaction Flaw (CWE-356) | |
| | - Security warning dialog suppressed | |
| | - Resolves external UNC resource automatically via Windows API | |
| | | |
| | Windows Security Support Provider Interface (SSPI / NTLM SSP) | |
| | | | |
| | v (Initiates Outbound SMB / WebDAV Connection over Port 445 / 80) | |
| +----------------------------------------------------------------------------------------------+ |
| | |
| v (NEGOTIATE_MESSAGE & AUTHENTICATE_MESSAGE with NTLMv2 Hash) |
| +----------------------------------------------------------------------------------------------+ |
| | ATTACKER ROGUE LISTENER (e.g., Responder, ntlmrelayx) | |
| | | |
| | Option A: Offline Dictionary / Brute-Force Cracking (Hashcat) | |
| | ===> Recovers Cleartext Active Directory Password | |
| | | |
| | Option B: Live NTLM Relay Attack (Zero Cracking Needed) | |
| | | | |
| | v (Relays NetNTLMv2 credentials to vulnerable internal corporate servers) | |
| | +------------------------------------------------------------------------------------+ | |
| | | TARGET INTERNAL CORPORATE SERVICES | | |
| | | - Active Directory Certificate Services (AD CS Web Enrollment / ESC8) | | |
| | | - Domain Controller LDAP (Signatures Disabled) | | |
| | | - File Servers (SMB Signing Not Enforced) | | |
| | +------------------------------------------------------------------------------------+ | |
| | | | |
| | v | |
| | Full Domain Privilege Escalation / Domain Admin Impersonation | |
| +----------------------------------------------------------------------------------------------+ |
| |
+----------------------------------------------------------------------------------------------------+
1. Vulnerability Anatomy: The Missing User Interaction Boundary
To understand why CVE-2026-124194 succeeds, one must examine how Microsoft Outlook handles external resources referenced within email message structures.
The Historic NTLM Leaking Landscape in Outlook
For years, Microsoft Outlook has been targeted by attackers seeking to coerce outbound NTLM authentication. Historical vulnerabilities—such as CVE-2023-23397 (abusing the PidLidAppointmentAuxiliaryFlags and custom reminder chime path)—exploited specific MAPI properties to force Windows to resolve Universal Naming Convention (UNC) paths like \\attacker-ip\share.
In response to previous exploits, Microsoft established strict defensive perimeters across the Office codebase:
- The External Content Blocker: Remote images and external stylesheets are blocked by default unless the sender is explicitly trusted.
- Untrusted Zone Warning Dialogs: When an email references a remote UNC path or non-local URI protocol, Outlook is required to display a prompt: "Outlook has blocked access to the following potentially unsafe components..." or require explicit user confirmation before delegating resource resolution to the operating system.
The CVE-2026-124194 Root Cause: CWE-356
CVE-2026-124194 breaks this defensive perimeter. The flaw resides within the parsing pipeline that processes message file headers and structured attachments.
When a crafted email incorporates an external resource URI formatted using specific nested encapsulation techniques, Outlook's internal security dispatch table fails to flag the URI as an external, untrusted boundary. Instead of halting execution and requesting user interaction, Outlook's rendering routines pass the unvalidated network path directly to internal Windows shell APIs (such as ShellExecuteEx or WNetAddConnection2).
Because the call occurs within the authenticated context of the logged-in Windows user, the operating system's Security Support Provider Interface (SSPI) automatically attempts to negotiate single sign-on authentication via the NTLM Security Support Provider (NTLMSSP):
- The Windows client connects to the remote host specified in the UNC path over TCP Port 445 (SMB). If Port 445 is blocked by perimeter egress firewalls, Windows automatically falls back to TCP Port 80 / 443 (WebDAV) via HTTP.
- The remote attacker server responds with a
CHALLENGE_MESSAGE(Type 2 NTLM message) containing a random 8-byte cryptographic server challenge. - Windows computes the NTLMv2 response by hashing the user's password, domain name, username, and server challenge using HMAC-MD5, and transmits this
AUTHENTICATE_MESSAGE(Type 3 NTLM message) back to the attacker.
All of this transpires silently in the background the moment an email is previewed in the reading pane, without presenting a single warning prompt to the victim.
2. Threat Intelligence & In-the-Wild Exploitation Mechanics
The operational risk of CVE-2026-124194 is severely amplified by the nature of NTLM authentication.
+---------------------------------------------------------------------------------------------------+
| Chronological Incident & Patch Timeline: CVE-2026-124194 |
+---------------------------------------------------------------------------------------------------+
| Date | Milestone / Telemetry Event |
+--------------------+------------------------------------------------------------------------------+
| Pre-Disclosure | Exploitation observed in targeted in-the-wild cyber espionage operations |
| November 10, 2026 | Microsoft publishes Patch Tuesday security update fixing CVE-2026-124194 |
| November 10, 2026 | CISA adds CVE-2026-124194 to Known Exploited Vulnerabilities (KEV) Catalog |
| November 10, 2026 | BleepingComputer, SecurityWeek report Outlook zero-day active exploitation |
| November 24, 2026 | CISA BOD 22-01 mandatory federal agency patching deadline |
+---------------------------------------------------------------------------------------------------+
Why the 6.5 CVSS Score Understates Reality
Microsoft assigned CVE-2026-124194 a CVSS 3.1 score of 6.5 (Moderate), with the vector string AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N:
AV:N(Network): The attack is delivered remotely over email.AC:L(Low Complexity): No specialized execution conditions are required.PR:N(No Privileges): The attacker requires no prior authentication.UI:R(User Interaction Required): The user must open or preview the email.C:H(High Confidentiality): Full disclosure of the user's NTLMv2 hash.I:N/A:N(No Integrity/Availability impact directly).
However, in practical offensive tradecraft, NTLM hash disclosure is virtually equivalent to remote code execution (RCE) when deployed against enterprise networks.
Exploitation Scenario 1: Real-Time NTLM Relaying (ESC8 / AD CS)
If the threat actor operates from an initial network foothold or can route traffic through a compromised VPN tunnel, they do not need to crack the captured NTLMv2 hash. Instead, they configure tools like ntlmrelayx to relay the live authentication stream directly to internal corporate services:
- The attacker sends the crafted email to a high-privilege domain user (e.g., an IT administrator or executive).
- The victim's Outlook triggers an outbound authentication connection to the attacker's rogue listener.
- The rogue listener immediately relays the incoming
Type 1,Type 2, andType 3NTLM messages to an Active Directory Certificate Services (AD CS) web enrollment endpoint (e.g.,http://adcs.corp.local/certsrv/). - Because the enrollment endpoint lacks Extended Protection for Authentication (EPA) or NTLM channel binding, the certificate server accepts the relayed credentials, issues a valid machine or user certificate on behalf of the victim, and returns it to the attacker.
- The attacker uses the newly acquired certificate to request a Kerberos Ticket-Granting Ticket (TGT) via PKINIT, achieving immediate, permanent domain administrative compromise.
Exploitation Scenario 2: Offline GPU Hash Cracking
If outbound traffic is captured across the public internet, the attacker captures the NetNTLMv2 hash string:
username::domain:challenge:HMAC-MD5:blob
The attacker feeds this hash to dedicated GPU clusters running Hashcat (Mode 5600). With modern consumer GPU arrays (e.g., NVIDIA RTX 4090 / 5090 clusters generating tens of billions of NTLM hashes per second), passwords complying with basic 8-to-12 character complexity rules can be cracked in hours or days, exposing the user's plaintext password for subsequent cloud (Entra ID / Office 365) logins.
3. Empirical Vulnerability & Affected Systems Matrix
The vulnerability impacts standard Microsoft Outlook desktop installations across enterprise and consumer editions.
+---------------------------------------------------------------------------------------------------+
| Affected Software and Patched Baseline Matrix: CVE-2026-124194 |
+---------------------------------------------------------------------------------------------------+
| Software Product | Vulnerable Versions | Patched Secure Baseline|
+-------------------------------+---------------------------+------------------------+
| Microsoft 365 Apps for Enterprise (Current) | Versions prior to Nov 10 | Version 2410 (Build 18129) |
| Microsoft 365 Apps (Monthly Enterprise) | Versions prior to Nov 10 | Updated Channel Builds |
| Microsoft Office LTSC 2024 | >= 16.0.0, < 16.0.17932 | Build 16.0.17932.21140 |
| Microsoft Office LTSC 2021 | >= 16.0.1, < 16.0.14334 | Build 16.0.14334.21048 |
| Microsoft Office 2019 / 2016 | All unpatched builds | November 2026 Update |
| Outlook on the Web (OWA) | Not Affected | Server-side rendering |
| Outlook for Mac / iOS / Android | Not Affected | Non-Windows NTLM stack |
+---------------------------------------------------------------------------------------------------+
The In-Memory Restart Requirement
A critical operational oversight in enterprise desktop management is failing to restart Outlook after automated patch distribution:
- Microsoft Office updates deploy dynamically in the background via the Click-to-Run (C2R) service or Windows Update.
- However, vulnerable DLL modules (such as
mso.dllandoutlook.exe) remain loaded in memory as long as the user's Outlook session remains active. - Telemetry indicates that over 40% of enterprise desktop endpoints remain vulnerable for days after update distribution simply because users leave Outlook running continuously across multi-day shifts.
4. Systems Engineering & Enterprise Hardening Playbook
Because CVE-2026-124194 is under active in-the-wild exploitation, enterprise security teams must enact immediate multi-layered defense-in-depth mitigations while patch verification progresses.
1. Perimeter Firewall Egress Filtering: Block Outbound Port 445
The single most effective defense against NTLM hash theft is severing outbound SMB communication at the network perimeter. Enterprise workstations should never initiate outbound connections over TCP Port 445 to external IP addresses on the public internet.
# PowerShell: Deploy Local Host Firewall Rule Blocking Outbound SMB (Port 445)
New-NetFirewallRule -DisplayName "Block Outbound SMB (CVE-2026-124194 Mitigation)" `
-Direction Outbound `
-LocalPort Any `
-Protocol TCP `
-RemotePort 445 `
-RemoteAddress "Internet" `
-Action Block `
-Profile Domain, Private, Public
2. Group Policy: Restrict Outgoing NTLM Traffic
Windows provides native Group Policy settings to restrict the generation and transmission of NTLM credentials to remote servers.
Active Directory Group Policy Configuration
Navigate to:
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options
- Policy:
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - Recommended Setting:
Deny all(orAudit allduring initial testing phase).
# Registry Key Implementation via PowerShell
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -Force | Out-Null
# Set RestrictSendingNTLMTraffic: 0 = Allow all, 1 = Audit, 2 = Deny all to remote servers
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" `
-Name "RestrictSendingNTLMTraffic" `
-Value 2 `
-Type DWord
3. Add Users to the "Protected Users" Security Group
Active Directory provides the Protected Users security group (introduced in Windows Server 2012 R2). Adding domain administrators, executive accounts, and service accounts to this group automatically enforces strict credential protections:
- NTLM authentication is disabled completely for members of this group.
- Windows never caches plain-text passwords or NTLM hashes in LSASS memory for these accounts.
- Even if an attacker forces an outbound SMB connection, Windows refuses to generate an NTLMv2 response, defeating the exploit entirely.
5. Threat Hunting & SIEM Detection Queries
Security Operations Centers (SOC) must proactively query endpoint detection and response (EDR) telemetry to identify whether endpoints have already been subjected to CVE-2026-124194 exploitation attempts.
Kusto Query Language (KQL) for Microsoft Sentinel & Defender for Endpoint
The following KQL detection identifies instances where OUTLOOK.EXE directly initiates or triggers outbound network connections to external IP addresses over SMB (Port 445) or WebDAV ports:
// Detect anomalous outbound SMB and WebDAV network connections originating from Outlook
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "OUTLOOK.EXE" or InitiatingProcessParentFileName =~ "OUTLOOK.EXE"
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
Windows Event Log Auditing for NTLM Authentication
When NTLM auditing is enabled via Group Policy (Audit all), Windows logs Event ID 8003 in the Microsoft-Windows-NTLM/Operational event log:
# PowerShell: Inspect Local Event Log for Blocked or Audited Outbound NTLM Connections
Get-WinEvent -LogName "Microsoft-Windows-NTLM/Operational" -FilterXPath "*[System[(EventID=8003)]]" -MaxEvents 50 |
Format-List TimeCreated, Message
6. Semantic FAQ: Microsoft Outlook CVE-2026-124194
What is the core vulnerability mechanism behind CVE-2026-124194?
CVE-2026-124194 is a missing user interaction flaw (CWE-356) in Microsoft Outlook for Windows. When processing crafted email messages containing remote network path references, Outlook fails to display the standard security confirmation dialog, delegating the request to the Windows networking stack, which automatically attempts outbound NTLM authentication and exposes the user's NTLMv2 hash.
Why is this vulnerability being actively exploited if it is rated Moderate (CVSS 6.5)?
While the vulnerability itself only leaks an authentication hash (earning a 6.5 confidentiality rating), attackers can immediately weaponize that hash. By relaying the stolen NTLMv2 credentials to unhardened enterprise services—such as Active Directory Certificate Services (AD CS) or LDAP—attackers achieve full remote domain administrative control without cracking passwords.
Does closing Outlook's reading pane prevent exploitation?
Closing the reading pane prevents automatic zero-click execution when browsing through an email folder. However, if the user double-clicks to open the message file, the exploit still triggers. Closing the reading pane is a helpful temporary risk mitigation, but applying the official security update and blocking outbound SMB are the only definitive remedies.
Are web and mobile versions of Outlook affected by CVE-2026-124194?
No. Outlook on the Web (OWA) renders email content through server-side Exchange proxies and does not interface with the local Windows NTLM authentication subsystem. Similarly, Outlook for macOS, iOS, and Android operate on non-Windows platforms that do not support or transmit NTLM authentication hashes.
What is the federal compliance deadline for CVE-2026-124194?
Because CVE-2026-124194 is under confirmed active exploitation, CISA added it to the Known Exploited Vulnerabilities (KEV) Catalog on November 10, 2026. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are legally required to apply the security update or discontinue use by November 24, 2026.
Who discovered and reported CVE-2026-124194?
Microsoft credited security researchers Benoit Sevens (using Claude with Anthropic) and nono for identifying and reporting the zero-day vulnerability.
Sources
- CISA Known Exploited Vulnerabilities Catalog (November 10, 2026): "CISA Adds Six Known Exploited Vulnerabilities to Catalog" — https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
- Microsoft Security Update Guide (November 10, 2026): "Microsoft Office Outlook Spoofing Vulnerability CVE-2026-124194" — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
- ThreatDefence Security Research (November 11–12, 2026): "Outlook CVE-2026-124194 NTLM Zero-Day: Patching and Hunting" — https://threatdefence.com/article/microsoft-outlook-cve-2026-124194-ntlm-zero-day-patching-hunting
- SecurityWeek Intelligence (November 10–11, 2026): "Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft" — https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/
- BleepingComputer Enterprise Security (November 10–11, 2026): "Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day" — https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/