[Urgent] Microsoft Outlook CVE-2026-124194: Added to CISA KEV on Nov 10 — Opening a Crafted Message File May Hand an Attacker Your Windows Login Hash (NTLMv2); Fixed in the Nov 10 Office Update (CVSS v3.1 6.5)

CVE-2026-124194, a vulnerability in Microsoft Outlook, was added to the KEV catalog of CISA, the US cybersecurity agency, on November 10, 2026. KEV lists vulnerabilities that have actually been exploited. In its own advisory published the same day, Microsoft also marks it 'Exploitation Detected'. Microsoft lists 'publicly disclosed' as 'No'.

First, update Microsoft 365 Apps (Office) and restart Outlook. According to Microsoft, an attacker sends a crafted message file and convinces the user to open it. Opening it can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning, and the user's NTLMv2 hash (a value Windows uses for login authentication) may be disclosed to the attacker. Microsoft says the attacker could use it to impersonate the user. The Preview Pane is not an attack vector (Microsoft).

Where the score comes from: 6.5 (CVSS v3.1) is Microsoft's value, and the only CVSS entry in the NVD. The NVD rates it MEDIUM and Microsoft's severity is 'Moderate'. The vector is: network, low complexity, no privileges required, user interaction required, scope unchanged, high impact on confidentiality, no impact on integrity or availability. But even at a medium score, it is already being exploited. Do not put it off because of the number.

What is happening (as far as it has been published)

• ▸CVE-2026-124194: Microsoft calls it 'Microsoft Outlook Spoofing Vulnerability'. The description says Outlook's UI does not warn the user of unsafe actions. The weakness type is CWE-356 (product UI does not warn user of unsafe actions)
• ▸What triggers it: Microsoft says an attacker sends a 'specially crafted message file' and convinces the user to open it. Another FAQ says the attacker must send a malicious Office file and convince the user to open it. User interaction is required: the user has to open the file (if it is not opened, this path does not work). Microsoft's FAQ does not limit this to files from unknown senders
• ▸What an NTLMv2 hash is: a value Windows uses in login authentication in place of the password itself. Microsoft says an attacker who gets it can authenticate as that user
• ▸CISA's KEV: added November 10; the due date for US federal agencies is November 24. Known use in ransomware campaigns is listed as 'Unknown'
• ▸Affected products (as Microsoft lists them): Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2024 (32-bit and 64-bit) and Microsoft Office LTSC 2021 (32-bit and 64-bit). The NVD lists the same six

What to do today

• ✓★Update Office and restart Outlook. On Windows, open any Office app such as Word and create a new document, go to File > Account (Office Account in classic Outlook), then in Product Information choose Update Options > Update Now (per Microsoft Support). If Update Options is missing and only About is shown, you have a volume-license install or your company manages updates. In that case, ask your company help desk
• ✓★Check the fixed build. Microsoft's release notes for Microsoft 365 Apps list this CVE under Outlook in the November 10 update. That day's builds are: Current Channel version 2610 (20527.20196); Monthly Enterprise Channel 2610 (20527.20194), 2609 (20430.20264) and 2608 (20326.20320); Semi-Annual Enterprise Channel 2610 (20527.20192), 2609 (20430.20262) and 2608 (20326.20318); Office LTSC 2024 Volume Licensed 2408 (17932.21140); Office LTSC 2021 Volume Licensed 2108 (14334.21048). If your build is at or above these, the November 10 update is installed. Microsoft's MSRC data lists the fixed builds for Office LTSC (16.0.17932.21140 for LTSC 2024 and 16.0.14334.21048 for LTSC 2021); for Microsoft 365 Apps it only points to the release notes, so the per-channel builds come from there
• ✓Do not casually open message files (such as .msg) or Office files until you have updated. That is exactly the path Microsoft describes. Be especially careful with attachments you were not expecting, and for unexpected files from people you know, confirm with the sender through another channel (our own note)
• ✓If you manage work computers, confirm the November update reached everyone and that Outlook was restarted. Microsoft explains that updates cannot be applied while an Office program that needs updating is in use, and are retried later. Close Outlook and other Office apps, let the update finish, then check your build
• ✓If you think you opened such an attachment, talk to your IT staff or company help desk. As our own note: because a login value may have leaked, follow your administrator's instructions on whether to change your password (Microsoft's information does not include password-change guidance)

What we could not confirm

• ▸The scale of attacks and who is behind them. Microsoft only says exploitation was detected; the sources we could confirm had no counts or attacker details
• ▸Outlook for Mac, the new Outlook for Windows, Outlook on the web, and Office 2019 and earlier. They are not among the six products Microsoft lists, but Microsoft does not say they are unaffected either. We did not check them for this article
• ▸Mitigations other than updating that Microsoft recommends. None appeared in the MSRC information we could read
• ▸The first fixed build for each Microsoft 365 Apps channel. The builds above are the ones listed under the November 10 update. We did not check whether earlier builds contain the fix
• ▸Damage in Japan. This article cannot show it
• ▸A score from NIST. As of November 13, the NVD had only Microsoft's 6.5

Three lines to share

• ▸CVE-2026-124194 in Microsoft Outlook was added to CISA's 'known exploited' catalog (KEV) on November 10. Microsoft also says exploitation was detected
• ▸★Update Office (File > Account > Update Options > Update Now) and restart Outlook. The fix is in the November 10 update
• ▸Do not open message files or Office files you were not expecting. Opening one may hand your login value to the sender (the preview pane is not affected)

Pages we relied on