Microsoft Outlook Zero-Day Spoofing Vulnerability (CVE-2026-124194)

Microsoft's November 2026 security updates have addressed CVE-2026-124194, a moderate-severity spoofing vulnerability in Microsoft Office Outlook that was actively exploited as a zero-day. The flaw resides in the product's UI failing to warn users before performing unsafe network actions, allowing a specially crafted message file to trigger an outbound connection to an attacker-controlled server without user notification.

Technically, this vulnerability facilitates the theft of NTLMv2 hashes. When a victim opens a malicious file, Outlook initiates a connection that causes Windows to attempt NTLM authentication, exposing the user's hash for offline cracking or relay attacks. CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing its immediate risk despite its moderate CVSS score. Organizations should prioritize patching Microsoft 365 Apps and Office LTSC versions to mitigate the threat of credential theft and subsequent lateral movement.