Outlook zero-day CVE-2026-124194: opening a single file can hand over your employees’ credentials
On Tuesday, November 10, 2026, Microsoft released its monthly update (“Patch Tuesday”): more than 1,000 vulnerabilities fixed at once. Only one was already being exploited by attackers, and it hits the tool your staff open first thing every morning: Outlook.
This Outlook zero-day, tracked as CVE-2026-124194, only received a 6.5 out of 10 score. Don’t trust the number. According to Microsoft, all it takes is an employee opening a booby-trapped message file for Outlook to connect, without the usual warning, to a server controlled by the attacker and send it a fingerprint of their Windows credentials (the “NTLMv2 hash”). With that fingerprint, the attacker can impersonate the employee. CISA, the U.S. cybersecurity agency, added it the same day to its list of actively exploited vulnerabilities.
Outlook zero-day: the booby-trapped message, annotated
Microsoft has not published the content of the messages used or the name of the attackers. So here’s a fictional example, built from the official description, to show your team what this kind of trap looks like:
What to notice
- 1An ordinary, believable pretext: a scan, a quote, a plausible client name.
- 2The trap isn’t a link but an attached message file. According to Microsoft, opening it triggers the connection to the attacker; the Preview Pane alone isn’t enough.
- 3Urgency pushes people to open without thinking. An hour’s delay changes nothing for a real client.
Once the file is opened, nothing visible happens on screen. That’s exactly the problem: the warning Outlook normally shows before loading external content doesn’t appear. Meanwhile, the credential fingerprint is sent to the attacker’s server.
What the attacker can do with that fingerprint
The NTLMv2 hash isn’t your password in plain text, but it can be used in two ways, Microsoft and Rapid7 researchers explain:
🔁
Live relay
The attacker immediately “replays” the fingerprint to sign in, as the employee, to another service on the network (file share, internal server) that still accepts NTLM without extra protection.
🔨
Offline cracking
They try to recover the password from the fingerprint, on their own computers. A short or common password falls quickly; a long passphrase holds up much better.
🏢
What comes next
With a valid account, they can read files, send emails as the employee or prepare a more serious attack, such as ransomware.
The risk is higher if your business still has a local Windows server, a file share or an Active Directory domain. A 100% Microsoft 365 SMB with multi-factor authentication is less exposed to relaying, but the password can still be cracked offline if it’s weak. Either way, the update is the real fix.
Is your Outlook protected? The 4-question test
🧭 Follow the questions in order
Key dates
Beyond the update: reduce the impact of the next similar flaw
This type of flaw, which “leaks” an NTLM fingerprint to the internet, keeps coming back. A few settings reduce the impact of the next one:
To do with your IT lead
- ☐ Block outbound SMB traffic (TCP port 445) to the internet at the firewall: your computers have no reason to connect to an external file share.
- ☐ Turn on SMB and LDAP signing on your servers, which prevents a large share of relay attacks, as Rapid7 points out.
- ☐ Lengthen passwords: a passphrase of 16 characters or more makes offline cracking much slower.
- ☐ Remind the team of the rule: don’t open a message file you didn’t ask for; call the sender at a known number.
- ☐ Watch for unusual sign-ins: an account signing in at odd hours or from odd places should trigger a check.
If you’ve already had an account taken over, remember that changing the password isn’t always enough: read our article on Microsoft 365 session theft. And to recognize the latest traps, see how the TA419 “AI committee” phishing worked.
Frequently asked questions
Q1. Is a 6.5 out of 10 score serious?
Yes, in this case. The score measures the flaw on its own, not what the attacker can do next. Microsoft lists it as exploited, and a credential fingerprint often opens the door to a broader attack.
Q2. Is the Preview Pane dangerous?
No, according to Microsoft, previewing in the Reading Pane doesn’t trigger the flaw. The booby-trapped file has to be opened. Hence the importance of the “I don’t open what I wasn’t expecting” reflex.
Q3. Do we know who is exploiting the flaw?
No. Microsoft gave no details about the attacks or the targets, and hasn’t published indicators of compromise. Those details may come out in the coming days.
Q4. Is antivirus enough?
It helps, but it doesn’t replace the fix. The Office update closes the flaw itself, whatever message comes in.
How NeoTech can help
For our managed IT services clients, the November Office and Windows fixes are deployed and checked computer by computer, with automated 24/7 monitoring with on-call technician intervention if a suspicious sign-in occurs. We also review your Microsoft 365 and firewall settings to limit credential leaks.
Book your free cyber check
In 30 minutes, we check with you whether your computers received the Outlook fix, whether outbound SMB traffic is blocked and where your weak spots are.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- SecurityWeek — Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (Nov. 10, 2026)
- BleepingComputer — Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
- SecurityOnline — Outlook Zero-Day CVE-2026-124194 Exploited in the Wild (fixed builds, CISA KEV listing)
- Rapid7 — Patch Tuesday, November 2026
- The Register — November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
Photo: Mikhail Nilov, Pexels (Pexels licence).