🔍 Read the full analysis: Your Outlook Zero-Day Patch Checklist For CISA’s November 24 Deadline on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft and CISA report active exploitation of CVE-2026-124194, an Outlook flaw that can expose a user’s NTLMv2 hash when a malicious file is opened. CISA’s November 24, 2026, deadline applies to U.S. federal civilian agencies; Microsoft says installing the applicable Office update is the fix. The attackers, targets and duration of exploitation have not been identified in the source material.
CISA has set November 24, 2026, as the remediation deadline for U.S. federal civilian agencies addressing CVE-2026-124194, a Microsoft Outlook vulnerability the agency says is being actively exploited. Microsoft has released Office updates that address the flaw, which can expose a user’s NTLMv2 hash if the user opens a specially crafted file in an affected Outlook version.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on November 10, citing evidence of active exploitation. Its entry directs agencies to apply vendor mitigations by November 24, or discontinue use of the affected product if mitigations are unavailable. Microsoft has shipped updates, and its entry lists no workaround.
Microsoft describes the issue as an Outlook spoofing vulnerability. An attacker without an account on the victim’s system can send a malicious Office file and try to persuade the recipient to open it. Microsoft says that opening the file could cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. That connection can disclose the user’s NTLMv2 hash, which Microsoft says an attacker could use to authenticate as the user.
The source identifies affected products as Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Microsoft lists fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, the source lists November 10 updates for multiple channels, including Current Channel Version 2610, build 20527.20196. Administrators should match installed builds to Microsoft’s release information for their specific update channel.
Your Outlook Zero-Day Patch Checklist For CISA’s November 24 Deadline
CISA says CVE-2026-124194 is being actively exploited. Microsoft has released updates; covered federal agencies must remediate by November 24, 2026.
Who must act by the deadline?
The binding directive applies to U.S. federal civilian executive branch agencies. CISA encourages other organizations to prioritize KEV-listed flaws.
- Apply the vendor update by November 24.
- If mitigation is unavailable, discontinue use of the affected product.
- The federal deadline is not binding on them.
- Prioritize remediation based on risk.
What the flaw can expose
The described attack requires a recipient to open a specially crafted file.
An attacker sends a crafted Office file and tries to persuade the recipient to open it.
Opening the file can prompt a connection to an attacker-controlled network location.
The connection can disclose the user’s NTLMv2 hash, which could be used in attempts to authenticate as that user.
Identify and verify the fix
Check installed builds against Microsoft’s release information for the specific product and update channel.
Fixed build
Verify version 16.0.14334.21048 in the installed edition.
Fixed build
Verify version 16.0.17932.21140 in the installed edition.
Match the channel
Check Microsoft’s release details for the installed channel; listed fixed builds vary by channel.
What the source does not establish
- Who is behind the exploitation, who was targeted, or how many were affected.
- When exploitation began or whether it is connected to ransomware.
- That an exposed hash led to account access or further compromise.
- A complete list of fixed Microsoft 365 Apps builds for every channel.
Why the Outlook Patch Deadline Matters
The flaw creates a credential exposure risk rather than directly allowing an attacker to run code, according to the source’s account of Microsoft’s assessment. A stolen NTLMv2 hash could be used in attempts to authenticate as the affected user, potentially giving an attacker a foothold in an organization’s environment. The source does not establish that every exposed hash leads to account access or further compromise.
The federal deadline gives civilian agencies a fixed date for addressing a weakness already listed as exploited. Organizations outside the federal civilian branch are not bound by this directive, but CISA encourages all organizations to prioritize vulnerabilities in the KEV catalog. For IT teams, the practical task is to check actual Office build numbers and update affected installations, rather than relying only on whether updates are generally enabled.
Microsoft rates the vulnerability Moderate, with a CVSS score of 6.5, according to the source. The attack requires a person to open a malicious file, and the source says the Preview Pane is not an attack vector. Those conditions shape the reported risk, but they do not remove the need to install the available fix, especially where Outlook is used to handle untrusted files.
Products Worth Considering
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
LG 27US500-W 27-Inch 4K UHD IPS Monitor
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
As an affiliate, we earn on qualifying purchases.
How CISA Set the November Deadline
CISA’s November 10 alert added six vulnerabilities to the KEV catalog, based on what the agency called evidence of active exploitation. The Outlook issue was listed alongside flaws affecting products from other vendors. Under the federal directive cited in the source, agencies must address cataloged vulnerabilities on a specified schedule.
The directive, BOD 26-04, applies only to federal civilian executive branch agencies, according to CISA’s alert. CISA separately encourages other organizations to use risk-based vulnerability management and prioritize KEV-listed flaws. That distinction matters: November 24 is a binding deadline for the covered agencies, not a universal legal deadline for every company or individual.
The source says Microsoft was the only vulnerability in its November release marked “Exploitation Detected”. Microsoft and CISA classify the issue as relating to a product interface that fails to warn a user about an unsafe action. The source also reports that Microsoft says a user must open the malicious file; merely viewing it in the Preview Pane is not an attack path.
What Is Not Known About Exploitation
The source material does not identify who is behind the attacks, who was targeted, how many people or organizations were affected, or when exploitation began. It also reports that CISA marks use in ransomware campaigns as “Unknown,” so the source does not establish a ransomware connection.
The source says CISA’s forensic-triage field is set to “no.” Under the directive as described there, that field identifies vulnerabilities for which agencies must also check for prior intrusion. That classification should not be read as proof that no systems were compromised. The available material provides no incident counts or forensic findings.
The source does not provide a complete list of Microsoft 365 Apps fixed builds: its supplied list cuts off during the Semi-Annual Enterprise Channel entries. Administrators should consult Microsoft’s current security update information for their channel and verify the installed build before treating a device as patched.
Verify Builds Before November 24
Covered federal civilian agencies must meet CISA’s November 24, 2026, deadline by applying the vendor update or following the directive’s instruction to discontinue use if a mitigation is unavailable. Microsoft has supplied the update, so organizations should identify affected Office installations, deploy the relevant fixed build and confirm that the update has taken effect.
Other organizations can use the same date as a prompt to prioritize remediation, though CISA’s binding requirement applies only to the covered federal agencies. IT teams should check each Microsoft 365 Apps channel against Microsoft’s release details, confirm LTSC build numbers, and communicate that opening a malicious file is the user action described in the attack. The source material does not give a later CISA milestone or an announced investigation update.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says opening a specially crafted file in an affected version can make Outlook connect to an attacker-controlled location and disclose the user’s NTLMv2 hash.
Who must meet CISA’s November 24 deadline?
The deadline applies to U.S. federal civilian executive branch agencies under the directive cited by CISA. CISA encourages other organizations to prioritize KEV vulnerabilities, but the source does not say this deadline is binding on them.
What should an organization do to fix the flaw?
Install the applicable Microsoft Office security update and verify the installed build against Microsoft’s release details for the product and update channel. The source says Microsoft lists no workaround.
Can the Outlook Preview Pane trigger the attack?
The source says Microsoft states the Preview Pane is not an attack vector. The described attack requires a user to open the malicious file.
Do we know who is exploiting the flaw or how many were affected?
No. The source material says the attackers, targets, number of affected organizations and start date have not been identified. It also reports that CISA lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
