🔍 Read the full analysis: How To Meet The November 24 Deadline For The Outlook Zero-Day on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft and CISA say attackers are exploiting Outlook vulnerability CVE-2026-124194, which can expose a user’s NTLMv2 hash after a malicious file is opened. US federal civilian agencies have until November 24, 2026, to apply the available Office updates; other organizations are urged to prioritize the flaw, but are not bound by that deadline.
CISA has set November 24, 2026, as the deadline for US federal civilian agencies to address CVE-2026-124194, an Outlook vulnerability that Microsoft says attackers are already exploiting. Microsoft has released Office updates that fix the flaw; CISA urges other organizations to prioritize it, although the federal deadline does not apply to them.
The vulnerability, identified by Microsoft as the Microsoft Outlook Spoofing Vulnerability, can expose a user’s NTLMv2 hash when the user opens a specially crafted file in an affected Outlook version. Microsoft says Outlook may connect to an attacker-controlled network location without showing the usual external-content warning. The attacker could then use the exposed hash to authenticate as the user, according to Microsoft’s description.
The attack requires a user to open the malicious file, but Microsoft says it does not require the attacker to be authenticated to the system. The Preview Pane is not an attack vector, according to Microsoft. The company rates the flaw Moderate, with a CVSS score of 6.5 out of 10; Microsoft also says it does not allow code execution.
Microsoft lists no workaround or mitigation in its vulnerability entry. Its stated fix is to install the relevant Office security update. Fixed builds named in the source include Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140. Microsoft 365 Apps fixes vary by update channel; administrators should compare installed versions with Microsoft’s November 10 release information for their specific channel.
How to Meet the November 24 Deadline for the Outlook Zero-Day
Attackers are exploiting an Outlook flaw that can expose a user’s NTLMv2 hash. Federal civilian agencies must apply the available Office updates by November 24, 2026.
Who must meet the date?
The cited directive applies to Federal Civilian Executive Branch agencies.
- Apply the relevant Office update by November 24.
- Confirm installed builds against Microsoft’s guidance.
- The federal date is not binding under the cited directive.
- CISA urges risk-based prioritization of the flaw.
How the vulnerability works
A user must open a specially crafted file in an affected Outlook version.
The attack requires a user to open the malicious file; the Preview Pane is not an attack vector.
Outlook may connect to an attacker-controlled network location without the usual warning.
Microsoft says the exposed NTLMv2 hash could be used to authenticate as the user.
Check the installed builds
Microsoft lists Office security updates as the fix and provides no workaround in the cited entry.
| Office product | Fixed build or action |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check the November 10 release details for the update channel |
Why the Hash Exposure Matters
The flaw matters because an exposed NTLMv2 hash can be used to authenticate as the affected user, according to Microsoft. In a workplace environment, an account credential can give an attacker a starting point for further access, although the material does not establish that attackers have used this flaw to move through networks or access particular systems.
The required user action and the absence of Preview Pane exploitation are relevant to how the attack works, but they do not remove the risk. Microsoft says a user must open a crafted file, while CISA’s catalog records evidence of active exploitation. Organizations should treat the flaw as a priority without assuming that every exposure has resulted in a compromised account.
For federal agencies, the catalog entry has a binding remediation date under CISA’s directive. For businesses, public bodies outside that scope and individual users, November 24 is not a legal deadline under the cited directive. It is still a useful signal of urgency because the flaw is being exploited and Microsoft has issued a fix.
Popular right now
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
KitchenAid 5.5-Quart Bowl-Lift Stand Mixer, Porcelain White
Philips Baristina Espresso Machine with Milk Frother (BAR308/60)
As an affiliate, we earn on qualifying purchases.
How the Federal Deadline Applies
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, citing evidence of active exploitation. The catalog entry gives federal agencies until November 24 to apply mitigations in line with vendor instructions. It says agencies should discontinue use of a product if mitigations are unavailable; Microsoft has released updates for the affected Office products.
CISA says the relevant directive, BOD 26-04, applies only to Federal Civilian Executive Branch agencies. The agency encourages all organizations to manage vulnerabilities according to risk and prioritize flaws listed in the KEV catalog. That encouragement is not the same as the federal compliance requirement.
The entry lists ransomware use as unknown and does not mark the flaw for forensic triage under the directive. CISA’s separate scoring identifies exploitation as active, automatable as no, and technical impact as partial. Those catalog fields describe CISA’s assessment; they do not identify who is conducting the attacks or which organizations have been affected.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its CVE-2026-124194 security entry
What the Exploitation Records Do Not Show
The available information does not identify who is behind the attacks, which people or organizations have been targeted, how many may have been affected, or when exploitation began. CISA’s catalog says the flaw is being exploited, but that classification does not provide a public incident count or name victims.
It is also not known whether attackers have used the flaw in ransomware campaigns: CISA lists that field as unknown. The fact that the entry is not marked for forensic triage should not be read as proof that no systems were compromised; it records the catalog’s status under the directive, not the outcome of an investigation into every organization.
The source material provides fixed builds for Office LTSC 2021 and 2024 and some Microsoft 365 Apps channels, but its channel list cuts off before giving every version and build. Administrators should consult Microsoft’s current security release details rather than infer that an unlisted channel is unaffected or already patched.
Check Builds Before November 24
Federal civilian agency IT teams should identify affected Outlook and Office installations, confirm the installed build against Microsoft’s fixed-version information, and deploy the relevant update before November 24, 2026. Because Microsoft 365 Apps updates differ by channel, teams should check each device or managed deployment against the build listed for its channel, then verify that updates have installed.
Organizations outside the federal directive can use the same steps as a risk-based response. Microsoft lists the update as the fix and provides no workaround in the cited entry. If an installation’s status is uncertain, administrators should check Microsoft’s security guidance for the specific Office product and update channel.
CISA’s catalog deadline is the next formal milestone for federal agencies. Further public information about attacker identities, victims, exploitation dates or possible ransomware use has not been established in the cited material.
Key Questions
Who must meet the November 24 deadline?
The deadline applies to US Federal Civilian Executive Branch agencies under CISA directive BOD 26-04. CISA recommends that other organizations prioritize the flaw, but the cited directive does not make the date binding on them.
What should organizations install to fix the flaw?
Microsoft says the Office security update is the fix and lists no workaround. The cited fixed builds are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps administrators should check the November 10 release details for the build matching their update channel.
Can simply previewing a file trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says a user must open a specially crafted file in an affected Outlook version.
Does CISA say the flaw has been used in ransomware attacks?
No such use is confirmed in the cited catalog entry. CISA lists ransomware use as unknown, while separately recording evidence of active exploitation.
Do we know who is being targeted?
The cited information does not identify the attackers, targets, number of affected organizations, or when the exploitation began. Those details remain unclear.
Source: ThorstenMeyerAI.com
