Executive Summary
Microsoft published CVE-2026-124194 on 10 November as a Moderate spoofing flaw with a CVSS score of 6.5, and confirmed in the same advisory that the flaw was already being exploited. CISA added it to the Known Exploited Vulnerabilities catalog that afternoon with a federal remediation date of 24 November, a 14-day window that no severity-driven patch schedule will match on a Moderate. The flaw makes Outlook contact a host the attacker chose and hand over an NTLMv2 response that authenticates as the signed-in user.
The update stops new delivery of the crafted message file. It does not invalidate a hash that already left the network. It does not stop Windows repeating the same behavior for the next file that names a remote host. The controls that break the chain sit outside Outlook, in outbound egress rules and identity hardening, and on the evidence of 2023 they hold where the client fix does not.
Microsoft called it Moderate. CISA called it exploited and put a date on it. Both were right, four hours apart, and the space between them is where this patch lands behind something else.
The gap between a 6.5 and a 9.8 is one click
Start with the line every summary repeated and almost nobody unpacked. Opening the file can cause Microsoft Outlook to connect to an attacker-controlled network location “without displaying the usual external-content warning”. That is the whole defect. Outlook reaching out was never the surprise. The promise that Windows would stop and warn you first was.
Microsoft filed it under CWE-356, product UI does not warn user of unsafe actions. The fix makes that warning fire. It does not make Outlook refuse the connection, and it does not make Windows refuse to answer with a credential.
The number follows the same framing. Confidentiality High, integrity None, scope Unchanged, total 6.5. Microsoft explains the High in one sentence. “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” A hash you can authenticate with is not a disclosure event. It is somebody else logging in as your employee.
The last time this shape appeared, Microsoft shipped CVE-2023-23397 for the same outcome, an Outlook object pointing at an attacker’s SMB share that leaked a Net-NTLMv2 hash. That one scored 9.8 and was used against governments, militaries and energy firms across Europe. The 2026 version sends the same payload to the same place and scores 6.5 because it needs a person to open a file.
CISA did not wait for the scorer. The KEV entry landed on 10 November under BOD 26-04, the directive that replaced BOD 22-01 in June, and sets 24 November for federal agencies. CISA grades each entry on its own. The two Barracuda flaws added the same afternoon got 13 November, three days out.
Patch it, then go looking for the connections it already made
The update closes the delivery path, so apply it. Then be honest about what is left. A hash captured in October still authenticates in December, and a client patch has never been a way to take a credential back. Microsoft’s 2023 guidance on the identical primitive is still the playbook, and its first step is hunting outbound authentication from client machines to hosts you do not recognize.
Egress is the control with the best return. Block outbound SMB on 445 and 139 from client segments to the internet, and block outbound WebDAV while you are in the rule set. CERT-EU recommended exactly that in 2023 as a default that should hold regardless of which CVE is current, because the Windows behavior outlives every client bug that triggers it.
Identity hardening covers the third link. Tier-zero accounts belong in Protected Users, where NTLM is refused outright. SMB signing makes a relayed connection fail. Extended Protection wherever the service supports it. All of it stays unapplied in plenty of environments, which is why the bug shape keeps working.
The release that buries this one carries a worse flaw nobody is using
November shipped about 1,090 new vulnerabilities by Zero Day Initiative‘s count, after roughly 1,400 in October. Most triage ranks a batch like that by score, and this bug sits below every Critical in it. One of those is CVE-2026-116928, a Windows Search remote code execution flaw rated 9.8 that fires when Exchange indexes a crafted attachment. The recipient opens nothing.
So the exploited flaw waits behind the un-exploited ones, because its number is smaller. A severity score describes the shape of a defect. It says nothing about whether somebody is already inside your network swinging it. That is what the KEV catalog measures, and why it is the list to sort by on patch day.
Three questions before 24 November. Does your firewall drop outbound 445 from the user VLAN, or only block inbound? Do you log NTLM authentication attempts to external addresses, and would a human read that alert at three in the morning? And when a hash is captured, is the response a password reset, or a shrug?
Related reading. Our analysis of the 974-CVE September release asked whether a cycle that size can be triaged at all. PHP2Shell showed what happens when exploitation starts before a fix exists.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.