November's only exploited Patch Tuesday flaw scores 6.5 and leaks the NTLMv2 hash through Outlook

Of the thousand-plus flaws Microsoft fixed in its 10 November Patch Tuesday release, 63 of them critical by CSO Online's count, only one is under attack, and it is not among the four rated 9.8. CVE-2026-124194 is an Outlook flaw scored 6.5 on CVSS that hands an attacker the NTLMv2 hash of anyone who opens a booby-trapped message file. CISA put it in its Known Exploited Vulnerabilities catalogue the same day.

The low score is technically justified: the victim has to open the file, and the impact CVSS measures stops at confidentiality. What the number leaves out is the value of the stolen hash afterwards, which on a network still running NTLM can be a great deal. Nick Carroll of Nightwing told CSO Online that a low score should not be read as low risk.

What is exploitable, and what is known about the attacks?

Microsoft's advisory classes the bug as spoofing and maps it to CWE-356, a user interface that fails to warn about an unsafe action. Qualys summarises the scenario: an unauthenticated attacker sends a crafted message file and persuades the target to open it, at which point Outlook reaches out to an attacker-controlled network location without the usual external-content prompt.

Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The fixed LTSC builds are 16.0.14334.21048 for 2021 and 16.0.17932.21140 for 2024, as SecurityOnline and Braindetox report from the CVE record. Microsoft 365 Apps receives the fix through each channel's 10 November build, listed in the Microsoft 365 Apps security release notes.

Microsoft has not said who is exploiting the flaw, since when, or against how many targets, and it has published no indicators of compromise. It was being exploited before any patch existed and, per the advisory, had not been publicly disclosed, which makes it a zero-day in the strict sense.

Which earlier Outlook bugs exposed the NTLM hash?

At least two since 2023. In 2023, with CVE-2023-23397, receiving the message was enough, and Palo Alto Networks' Unit 42, as reported by SecurityWeek, found APT28 using that bug against at least 30 organisations in 14 countries. In 2024 Check Point Research showed how a malformed link slipped past Protected View. This time someone has to open a file, and someone is still making it pay.

How does a hash travel from Outlook to the attacker?

The underlying behaviour is old. When Windows accesses a resource on a network path, over SMB or WebDAV, it tries to authenticate automatically with the signed-in user's credentials. If the server at the other end belongs to the attacker, it receives the NTLMv2 challenge-response. That is not the password, but it has two uses: relaying it on the spot to another service that accepts NTLM without signing or channel protection, or attempting to crack it offline to recover the password, which works best against short or common ones.

Outlook has safeguards to stop a message triggering such connections unprompted, and the external-content warning is one of them. This update closes a path where the warning never appears. Microsoft states that the preview pane is not an attack vector, which narrows the scenario to the file being opened.

The expected trace is an outbound connection from the workstation to an external IP on TCP 445 or, where SMB is filtered, a WebDAV request over HTTP or HTTPS handled by the Windows WebClient service. Later, on the affected account, network NTLM logons may start arriving from sources that do not fit its usual pattern, a common sign of relaying or lateral movement.

Who is most at risk?

Any machine running classic desktop Outlook on an affected build, though the risk is unevenly spread. An office whose internet egress filters port 445 cuts off the direct SMB route. A laptop at home, in a hotel or on a client's guest Wi-Fi has no such filter, which is why remote working accounts for much of the exposure.

What an attacker can do with the hash matters just as much. If servers require SMB signing, LDAP enforces signing and channel binding, and internal web services use Extended Protection for Authentication, relaying becomes far harder. If the account belongs to an administrator with a short password, the stakes rise sharply. Office 2019 and retail editions are absent from the product list, and the advisory does not say whether they are affected. Even so, the 10 November security notes include builds for Office 2019 volume licensed (10417.20236) and Office 2021 and 2024 retail (20527.20196), which should be installed regardless.

The KEV listing for CVE-2026-124194 is what puts it at the top of the queue; our guide to prioritising with KEV, EPSS and SSVC explains the reasoning. The Exchange OWA zero-day we covered in the summer had already shown how far an attacker can get once someone simply opens an email.

How can the attack be detected and contained?

Through behaviour-based hunting, since Microsoft has published no indicators. The KQL below, written for Microsoft Defender XDR, is a starting point for organisations with EDR in place. First, outbound SMB connections to the internet over the past 30 days. Windows opens them, not outlook.exe, so the query does not filter by process, and results need matching against Outlook activity in the same time window:

DeviceNetworkEvents | where Timestamp > ago(30d) | where RemotePort in (139, 445) and RemoteIPType == "Public" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIP, RemotePort, ActionType

Second, the WebDAV client spinning up, which can point to remote paths being reached over HTTP. It is noisy wherever WebDAV is used against SharePoint, so its value lies in lining it up with the time an attachment was opened:

DeviceProcessEvents | where Timestamp > ago(30d) | where FileName =~ "rundll32.exe" and ProcessCommandLine has "davclnt.dll" | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Third, inbound message-type attachments (.msg or .eml). This is a working hypothesis: Microsoft has not specified the exact format, and its own advisory also refers to an "Office file", so other formats cannot be ruled out:

EmailAttachmentInfo | where Timestamp > ago(30d) | where FileName endswith ".msg" or FileName endswith ".eml" | join kind=inner (EmailEvents | where EmailDirection == "Inbound") on NetworkMessageId, RecipientEmailAddress | project Timestamp, SenderFromAddress, RecipientEmailAddress, FileName, Subject

The relay stage shows up as accounts logging on over network NTLM from an unusual spread of sources. Where Defender for Identity is deployed, the same logic can run on IdentityLogonEvents, which covers domain controllers:

DeviceLogonEvents | where Timestamp > ago(30d) | where Protocol =~ "NTLM" and LogonType == "Network" | summarize Sources = dcount(RemoteIP), Devices = dcount(DeviceName) by AccountName | order by Sources desc

If a suspicious connection turns up, the user's password should be treated as exposed, which means resetting it, reviewing recent sign-ins and checking whether it has been tried elsewhere, starting with privileged accounts. Decoy accounts in Active Directory help catch anyone replaying credentials inside the network, and a threat hunting exercise scoped to these signals helps review the weeks before the patch.

Is there a fallback while patching is pending?

Not an official one: the fix is the 10 November Office update, and Microsoft's advisory lists no workaround. With Microsoft 365 Apps, the update channel can be where things slip. A device with updates held back by an old policy, or pinned to a specific version, can miss the corrected build even while the console reports Office as self-updating. The build installed on each machine is what has to be checked.

In the meantime, the following measures reduce exposure, although Microsoft does not present them as a mitigation for this specific CVE:

• Outbound TCP 445 and 139 to the internet can be blocked at the perimeter and, for devices that work off-site, in the host firewall, which travels with the laptop.
• The WebClient service can be disabled on machines that have no need for WebDAV.
• Privileged accounts can move into the Protected Users group, which stops them authenticating with NTLM, in line with an Active Directory tiering model.
• The "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy has an audit mode, which should come before any block. Our guide to retiring NTLM without breaking the network covers the full process.
• With SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication all required, a stolen hash is much harder to relay.

None of these replaces the patch, and the third and fifth can break legacy applications if applied without an inventory. A vulnerability management programme that tracks the Office build per device, and not only Windows Update status, shows which machines are still exposed.

What should defenders watch over the coming days?

First, whether Microsoft or a threat intelligence team publishes attribution and indicators, which would sharpen the hunts above. Second, 24 November, the deadline CISA has set for US federal agencies and a sensible yardstick for any European organisation.

Third, who found the bug. According to SecurityOnline, Microsoft credits Benoit Sevens, working with Anthropic's Claude model, alongside a researcher known as nono. Satnam Narang of Tenable told CSO Online that for most of the year AI had been "building bigger haystacks" across Patch Tuesday releases, and that this appears to be the first time it has found a needle. A single vulnerability is no basis for a trend, but it may shift a debate that until now has been about volume.

For anyone running a patch programme, November inverts the usual order. The 6.5 that arrives by email and is already in use goes first; the 9.8 flaws in LDAP and Exchange follow, not flagged as exploited by Microsoft, though they sit on domain controllers and mail servers. These Outlook and identity checks are also where our Microsoft 365 security work begins.

Sources and methodology: this analysis draws on public information from Microsoft, CISA, Qualys, SecurityOnline, Braindetox, CSO Online, SecurityWeek and Check Point Research as of 14 November 2026. Microsoft has published no attribution or indicators of compromise, and the picture may change.

Disclaimer: the KQL queries and hardening measures are indicative and provided for defensive purposes. They should be tested before production use, with names, time windows and thresholds adapted to each environment; restricting NTLM or disabling WebDAV without prior auditing can disrupt applications.