Outlook CVE-2026-124194: Exploited NTLMv2 Hash Disclosure on KEV

**CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, describing a Microsoft Office Outlook flaw where missing warnings before unsafe actions let an attacker perform network spoofing. Microsoft's November 10 Office security release notes ship fixes across Microsoft 365 Apps and Office LTSC channels, listing CVE-2026-124194 under Outlook. If you run Outlook on the same workstation as Claude Code or Codex, install the November 10 security build for your update channel and stop opening untrusted .msg / message files even when they look like vendor tickets.

This sits in the same November wave as our Microsoft October Patch Tuesday primer; November's exploited item is Outlook-specific rather than Windows shell.

TL;DR

What public sources agree on

CISA KEV (primary)

CISA's entry names Microsoft Office Outlook, weakness CWE-356 (missing user interaction for potentially unsafe action), and links MSRC plus NVD. Required action: follow vendor mitigations under BOD 26-04.

Microsoft Learn release notes (primary)

The Microsoft 365 Apps security updates page dated November 10, 2026 lists channel builds (Current, MEC, SAC, LTSC volume licenses) and enumerates CVE-2026-124194 under Outlook, alongside many other Office CVEs in the same drop.

Example fixed volume builds from that page:

Managed tenants should align with Intune/ConfigMgr deployment rings rather than retail numbers alone.

Attack chain (from November 2026 Patch Tuesday reporting)

Multiple outlets publishing Microsoft's advisory language describe the same chain (we did not reproduce exploitation):

1. Attacker sends a crafted Outlook message file (not merely mail in the inbox — a file the user opens).
2. Victim opens the file in vulnerable Outlook (Preview Pane not sufficient per Microsoft notes quoted in SecurityWeek's Patch Tuesday coverage).
3. Outlook connects to an attacker-controlled network location without the usual external-content / unsafe-action warning.
4. Authentication material — described as the user's NTLMv2 hash in that coverage — may be exposed to the attacker for relay or offline crack, enabling user impersonation.

Microsoft assigned Moderate severity and CVSS 6.5 in the same reporting; exploitation in the wild is why CISA prioritized it despite the label.

Discovery credit in roundups includes researcher nono and Benoît Sevens, with acknowledgment text noting Claude assisted analysis — meta, but useful for teams tracking AI-assisted vuln research supply.

Moderate label versus exploited reality

Microsoft's Moderate severity and 6.5 CVSS score reflect constrained user interaction and spoofing class impact, not attacker interest. CISA KEV and Microsoft's exploited flag for November 2026 reorder priority ahead of many Important RCE bugs that lack in-the-wild use. Patch boards should sort by KEV and vendor exploitation bit, not headline CVSS alone.

NTLMv2 exposure in developer environments

When Outlook discloses an NTLMv2 hash, attackers may attempt relay against SMB, WebDAV, or legacy enterprise services still tolerant of NTLM. Developer laptops often have:

• Always-on VPN interfaces that expose corp SMB.
• Local IIS or WebDAV tooling left enabled for testing.
• Cached corporate credentials used by agents launching git or az CLIs.

Even without relay, offline cracking of weak passwords remains viable for NTLM hashes. Force Windows Hello / FIDO where policy allows and enforce long, random passwords on developer domain accounts.

How to check and patch

Version check (Windows)

Inside Outlook: File → Office Account → About Outlook, or cross-check against the Learn release notes table for your channel.

Patch deployment

• Microsoft 365 Apps: allow the November 10 security update through your normal ring.
• LTSC: target the 16.0.14334.21048 / 16.0.17932.21140 builds or newer security baselines Microsoft publishes for each SKU.
• Mac Outlook: use Microsoft AutoUpdate; verify build against the same Learn page family for Mac if listed.

Containment until patch

• Do not open unknown .msg or saved message attachments from ticket systems — common in spearphishing against engineers.
• Disable or restrict legacy NTLM where policy allows; compare with Chrome KEV patching on the same host — browser and office flaws often chain in watering-hole campaigns.

November 2026 Patch Tuesday scale

SecurityWeek's November coverage tallies 1,094 fixes across Microsoft's portfolio, with Outlook accounting for multiple CVEs in the same Learn document. CVE-2026-124194 is the exploited centerpiece; CVE-2026-124227 and CVE-2026-124228 are additional Outlook issues rated Important in roundups but not flagged exploited.

Batching Outlook updates reduces restart friction: schedule one maintenance window for all November Office security/CVE items rather than cherry-picking a single KB.

User training for .msg files

Helpdesk flows sometimes ask engineers to open a saved ticket export for debugging. Treat message files from unknown senders like executable attachments:

• Scan with endpoint protection.
• Open in a hardened VM if review is mandatory.
• Prefer web Outlook only when policy says Preview Pane risk is acceptable — still not a substitute for the desktop patch.

Signs of compromise to hunt

Without vendor IOCs, hunt for:

• Unexpected SMB outbound from Outlook.exe shortly after opening attachments.
• Failed NTLM auth spikes on domain controllers from developer workstation IPs.
• New inbox rules forwarding mail — attacker persistence after hash relay succeeds.

What this means if you run AI coding agents

• Same machine risk: Agents do not patch Outlook for you. A compromised Windows identity via NTLM relay reaches git credentials, OneDrive-synced repos, and browser profiles agents already use.
• Helpdesk social engineering: Attackers may file fake "agent install" tickets with .msg proofs — train reviewers not to open them on primary dev laptops.
• Email gateway chain: If Barracuda ESG is unpatched, attackers may pair gateway control with client-side Outlook bugs for higher success rates.
• Beam hook context: Claude Code account email header leak is HTTP metadata leakage — separate from NTLM, but both undermine identity assumptions around agents.

What Beam can and cannot do here

Beam does not inspect Outlook binaries or block .msg opens. It can:

• Flag agent shell commands that attempt NTLM relay tooling or hash capture scripts when workspace enforce is on.
• Scan skills that tell agents to open arbitrary message downloads without checksum verification.

That is adjunct containment, not a substitute for the Office update.

BOD 26-04 and federal contractor readers

CISA's KEV entry links BOD 26-04 prioritization. Federal systems must track due dates; private teams can borrow the same cadence — exploited Office client bugs on developer laptops should not wait for the next monthly patch carnival if security releases are available.

Mac and mobile Outlook

Developers on Outlook for Mac should verify builds against Microsoft's November release family for Mac. iOS Outlook may update via App Store separately; confirm Microsoft's November security communication for mobile if your MDM profile pins versions.

Agent tooling on macOS still depends on Outlook desktop for many enterprises using .msg artifacts from Windows colleagues — cross-platform patch parity matters in mixed teams.

Coordinating Outlook patch with identity providers

If your organization uses Entra ID or on-prem Active Directory, combine the Office patch with:

• NTLM restriction policies (block NTLM outbound where possible on dev VLANs).
• EPA / hardened SAML for Git and cloud CLIs so stolen hashes have fewer relay targets.
• Review of legacy apps agents launch that still prompt for domain credentials.

None of that removes the need for CVE-2026-124194 binaries, but it shrinks what a captured hash buys.

Purple-team view for agent operators

Red teams simulating spearphishing engineers often deliver .msg lures themed as CI failures. Tabletop with coding-agent squads:

1. Would your on-call open the file on a laptop with production API keys?
2. Does your MDM enforce November 10 Office builds within 72 hours?
3. After patch, do agents still have cached imap/smtp passwords in config files worth rotating?

Document answers in the same runbook slot as vendor breach first 24 hours.

Extended FAQ-style checklist (operations)

Outstanding items belong in the November Patch Tuesday epic, not a silent backlog while engineers keep opening mail attachments from fake CI bots.

Closing scope note

We did not reproduce CVE-2026-124194. Scope rests on CISA KEV, Microsoft Learn November 10 Office updates, and SecurityWeek's Patch Tuesday summary quoting Microsoft's exploitation and NTLM language. Update this post if MSRC publishes richer CVE detail than the SPA page currently exposes to automated fetch.

If Microsoft's FAQ later clarifies additional file formats or Outlook SKUs, refresh the Affected builds table from Learn rather than third-party CVSS aggregators — build numbers drift weekly in the Current Channel.

Frequently asked questions

Is this mail-body phishing?

Public text emphasizes a message file open path, not generic HTML mail rendering.

Public disclosure before patch?

SecurityWeek reports no public disclosure prior to the fix shipping.

Cloud-only Outlook?

This targets classic Office Outlook builds in the Learn lists; web Outlook has a different surface — still patch desktop installs used on developer hardware.

Relationship to other November Outlook CVEs?

The same release lists CVE-2026-124227 and CVE-2026-124228 as Important Outlook code execution issues without exploited flags in roundups — patch them in the same maintenance window.

Related reading

• N-able Able2Shell: N-central Hotfix 2 and RMM endpoint risk
• Microsoft October 2026 Patch Tuesday overview
• Barracuda ESG chained KEV flaws
• Chrome CVE-2026-125350 exploited XML flaw
• First 24 hours after a vendor breach
• Claude Code email header leak
• Warp vendor breach claimed vs verified
• Beam: local-first observability

Build numbers follow Microsoft Learn release notes as of 2026-11-10. MSRC detail pages may require interactive browsing beyond automated fetch.