Active Exploitation of CVE-2026-124194 in Microsoft Outlook Allows NTLMv2 Credential Capture
A security vulnerability identified as CVE-2026-124194 in Microsoft Outlook has been actively exploited to capture Windows authentication hashes (NTLMv2) by tricking users into opening specially crafted message files. This flaw allows attackers to bypass the usual external content warning and sends authentication data to a malicious server, enabling potential impersonation of the user on other systems. While classified as moderate severity with a CVSS score of 6.5, the exploitation requires user interaction and network connectivity. A patch was released by Microsoft on November 10, 2026, as part of their monthly security update. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The discovery credited researchers Nono and Benoît Sevens, with Sevens employing the Claude AI model during analysis. The US CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating patching by November 24, 2026, for federal civilian agencies. This flaw is part of a broader set of 1,259 fixes including numerous elevation of privilege and remote code execution vulnerabilities in Windows and Office products released in the November patch cycle.
Entenda a falha
A vulnerabilidade
CVE-2026-124194 is a spoofing flaw in Microsoft Outlook (CVSS 6.5, rated moderate by Microsoft). An attacker has to convince a user to open a specially crafted message file, and the victim's machine needs network connectivity. The attacker gets the user's NTLMv2 authentication hash, which can be used to try to impersonate the user on other systems. It affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft fixed it in the November 10, 2026 Patch Tuesday, after exploitation had already started.
Como funciona
The victim receives a malicious message file and opens it in an affected version of Outlook. On opening, Outlook connects to a network address controlled by the attacker, and this happens without the usual warning about external content. During that connection, Windows authentication information, including the NTLMv2 hash derived from the user's credentials, is sent to the attacker's server. The hash is not the plain password, but it can be used in authentication attempts or cracked offline. Merely receiving the message is not enough, and the Outlook preview pane is not an attack vector.
Por que é vulnerável
The articles do not describe the root cause in code terms. What they say is that the flaw lets the crafted message file bypass Outlook's normal external-content warning, so the outbound connection to the attacker's server happens silently and leaks the NTLMv2 hash. The articles do not detail what the patch changes.
Como foi descoberta
Microsoft credited the researchers identified as Nono and Benoît Sevens, and said Sevens used Anthropic's Claude AI model during his analysis of the flaw. Microsoft confirmed the flaw was exploited before the patch was released on November 10, 2026. CISA added it to its Known Exploited Vulnerabilities catalog with a November 24, 2026 deadline for US federal civilian agencies. The articles do not say how or when it was first reported.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles confirm exploitation in the wild, so a working exploit exists in attackers' hands. None mentions a published proof of concept or public exploit code. Since attacks are already happening, patching is urgent despite the moderate rating.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 19:16.
Linha do tempo
-
Active Exploitation of CVE-2026-124194 in Microsoft Outlook Allows NTLMv2 Credential Capture
ler a análise desta fonte ocultar
A security vulnerability identified as CVE-2026-124194 in Microsoft Outlook has been actively exploited to capture Windows authentication hashes (NTLMv2) by tricking users into opening specially crafted message files. This flaw allows attackers to bypass the usual external content warning and sends authentication data to a malicious server, enabling potential impersonation of the user on other systems. While classified as moderate severity with a CVSS score of 6.5, the exploitation requires user interaction and network connectivity. A patch was released by Microsoft on November 10, 2026, as part of their monthly security update. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The discovery credited researchers Nono and Benoît Sevens, with Sevens employing the Claude AI model during analysis. The US CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating patching by November 24, 2026, for federal civilian agencies. This flaw is part of a broader set of 1,259 fixes including numerous elevation of privilege and remote code execution vulnerabilities in Windows and Office products released in the November patch cycle.