🔍 Read the full analysis: CISA Sets A November 24 Deadline: Outlook Zero-Day Patch Guide on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CISA added Microsoft Outlook vulnerability CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on Nov. 10, citing evidence of active exploitation. Federal civilian agencies must apply the available Microsoft update by Nov. 24, 2026; other organizations are urged to prioritize remediation.
CISA has set Nov. 24, 2026, as the deadline for U.S. federal civilian agencies to address CVE-2026-124194, a Microsoft Outlook vulnerability that the agency says is being actively exploited. Microsoft has released updates that fix the flaw, which can expose a user’s NTLMv2 authentication hash after they open a specially crafted file.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 10, citing “evidence of active exploitation.” The catalog directs affected federal agencies to apply mitigations according to vendor instructions, and says they should discontinue use of a product if mitigations are unavailable. Microsoft has issued updates for the affected Office products.
Microsoft describes the issue as an Outlook spoofing vulnerability. An attacker without an account on the target system can send a malicious Office file and try to persuade its recipient to open it. According to Microsoft, Outlook may then connect to an attacker-controlled network location without displaying its usual external-content warning, exposing the user’s NTLMv2 hash. Microsoft says an attacker could use that hash to authenticate as the user.
The attack requires a person to open the file. Microsoft says the Preview Pane is not an attack vector, and the flaw does not itself allow code execution. Microsoft rates it “Moderate,” with a CVSS score of 6.5 out of 10. The affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions.
Microsoft lists no workaround for the issue; installing the relevant update is the fix. The source material identifies fixed builds of 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, Microsoft’s Nov. 10 release lists fixed builds across its update channels, so administrators should check the applicable channel and installed build against Microsoft’s security guidance.
Outlook Zero-Day Patch Deadline
CISA says attackers are exploiting an Outlook vulnerability that can expose users’ NTLMv2 hashes. Federal civilian agencies must apply Microsoft’s update by November 24, 2026.
How the flaw can expose credentials
The attack requires a recipient to open a specially crafted Office file.
An attacker sends an Office file and tries to persuade the recipient to open it.
Outlook may connect to an attacker-controlled location without its usual warning.
The exposed NTLMv2 hash could be used to authenticate as the user.
Who must act
CISA’s deadline applies to federal civilian executive branch agencies; other organizations are urged to prioritize the vulnerability.
- Apply the available Microsoft update by November 24, 2026.
- Verify affected Office installations and builds.
- Prioritize the KEV-listed flaw through risk-based remediation.
- Review affected Outlook versions and install the applicable update.
Affected Office products
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 among affected products.
| Product | Fixed build in source |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | Check the applicable update channel guidance |
Why the Outlook Deadline Matters
The deadline is a binding requirement for federal civilian executive branch agencies, not a universal compliance date for every organization. CISA says its directive applies only to those agencies. It also encourages all organizations to use risk-based vulnerability management and prioritize flaws in the KEV catalog, making the Nov. 24 date a practical signal for private-sector security teams even though it is not a rule for them.
The risk is tied to credential exposure rather than direct code execution. A stolen NTLMv2 hash may give an attacker a way to authenticate as the affected user, which could create further risks inside an organization’s network. Because the attack requires a recipient to open a file, timely patching should be paired with care around unexpected Office files. That is risk-management context, not a claim that every exposed hash will lead to further compromise.
CISA’s catalog information also distinguishes active exploitation from other possible outcomes. The source reports that ransomware use is listed as “Unknown” and that the entry is not marked for forensic triage. Those fields do not establish whether any particular organization has been compromised; they describe what the catalog records for this vulnerability.
Products Worth Considering
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
FlexiSpot E6 Electric Standing Desk, 55 × 28 in, Bamboo Top, White Frame
FLEXISPOT 36-Inch Height-Adjustable Standing Desk Converter with Keyboard Tray, Black
As an affiliate, we earn on qualifying purchases.
How CISA and Microsoft Classified the Flaw
The flaw is identified in Microsoft’s security materials as CVE-2026-124194, or the Microsoft Outlook Spoofing Vulnerability. Microsoft and CISA classify it as CWE-356, described by Microsoft as a product interface that fails to warn a user about an unsafe action. The vulnerability’s central problem, according to Microsoft, is that Outlook can make the network connection without the warning users would normally expect.
CISA’s Nov. 10 alert added six vulnerabilities to the KEV catalog based on evidence of active exploitation. The additions covered products from several vendors, including Microsoft. CISA’s record for the Outlook issue lists exploitation as active, automatable as no, and technical impact as partial. The source article interprets those entries as consistent with an attack requiring user interaction; that interpretation should be distinguished from CISA’s recorded fields.
Microsoft’s severity rating is “Moderate,” with a 6.5 CVSS score, while CISA’s KEV listing reflects evidence that attackers are using the flaw. These are different measures: the severity score describes assessed technical risk, while the catalog addition and exploitation status communicate that the vulnerability has been observed in use.
““based on evidence of active exploitation””
— CISA, in its Nov. 10, 2026, KEV catalog alert
What Is Still Unknown About Exploitation
The available source material does not identify who is behind the attacks, which organizations or individuals have been targeted, how many may have been affected, or when exploitation began. CISA’s active-exploitation designation confirms that the flaw is being used, but does not supply those details.
It is also not clear from the cited material whether attackers have successfully used captured hashes to access accounts or systems, or whether any specific organization has been compromised. CISA lists ransomware use as unknown. The absence of a forensic-triage designation in the catalog should not be treated as proof that an organization has no need to investigate suspicious activity; the source describes it as a catalog field, not a finding about every affected environment.
The source lists fixed build numbers for Office LTSC and says Microsoft’s Nov. 10 release includes fixes for Microsoft 365 Apps channels. Administrators should consult Microsoft’s current release guidance for the complete build applicable to their channel. The supplied channel list is cut off after part of the Semi-Annual Enterprise Channel information, so a complete channel-by-channel version list cannot be confirmed here.
Patch Checks Before November 24
Federal civilian agencies face the Nov. 24, 2026, deadline in CISA’s catalog and should verify that affected Office installations have received the relevant Microsoft update. IT teams can check installed Office builds and compare them with Microsoft’s security update guidance for the organization’s product and update channel. The source identifies fixed LTSC builds as 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024.
Organizations outside the federal civilian executive branch are not bound by this specific directive, but CISA urges all organizations to prioritize KEV catalog vulnerabilities. Teams should review whether affected Outlook versions remain in use, apply the appropriate update, and follow their normal procedures for handling suspicious files and possible credential exposure. The source provides no separate workaround where patching is unavailable.
Further details about the attackers, the extent of exploitation, and any confirmed incidents may emerge from Microsoft, CISA, or affected organizations. Until then, the confirmed operational step is to install the applicable update and verify that the affected Office build is no longer present.
Key Questions
What is the Nov. 24 deadline for?
It is CISA’s remediation deadline for U.S. federal civilian executive branch agencies addressing CVE-2026-124194. CISA says the directive applies only to those agencies, while urging other organizations to prioritize KEV catalog vulnerabilities.
What happens when the Outlook flaw is exploited?
Microsoft says a user must open a specially crafted file. Outlook may then connect to an attacker-controlled network location without its usual warning, potentially exposing the user’s NTLMv2 hash, which Microsoft says could be used to authenticate as that user.
Does opening the Preview Pane trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says the recipient must be convinced to open the malicious file.
Which update fixes CVE-2026-124194?
Microsoft lists Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed. Microsoft 365 Apps users should check the security release guidance for the fixed build for their specific update channel.
Who is being targeted, and is ransomware involved?
The source material does not identify the attackers, targets, number of affected users, or start date for exploitation. CISA lists use in ransomware campaigns as unknown; the available information does not confirm ransomware involvement.
Source: ThorstenMeyerAI.com
