🔍 Read the full analysis: What To Patch Now As CISA Sets An Outlook Zero-Day Deadline on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026. Federal civilian agencies have until Nov. 24 to apply Microsoft’s available Office updates; other organizations are urged to prioritize the flaw, but the deadline does not bind them.
CISA has set Nov. 24, 2026, as the deadline for U.S. federal civilian agencies to address CVE-2026-124194, an Outlook vulnerability that Microsoft marks as exploited and CISA says is under active attack. Microsoft has released Office updates that fix the flaw, which can expose a user’s NTLMv2 authentication hash when the user opens a specially crafted file.
Microsoft describes the issue as a spoofing vulnerability that can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. Microsoft says an attacker could use the exposed NTLMv2 hash to authenticate as the user. The attack requires someone to open a malicious file, but it does not require the attacker to have an account on the victim’s system. Microsoft says the Preview Pane is not an attack vector.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 10, saying the additions were based on evidence of active exploitation. Under the agency’s directive, federal civilian executive branch agencies must apply vendor mitigations by Nov. 24; if mitigations are unavailable, the directive calls for discontinuing use of the product. CISA encourages other organizations to prioritize KEV-listed vulnerabilities, but the federal deadline is not a requirement for them.
Microsoft lists Office LTSC 2021 and 2024 and Microsoft 365 Apps for Enterprise among the affected products, in both 32-bit and 64-bit editions. The fixed builds listed in the source material include 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps, the November 10 release lists different builds for each update channel. Microsoft’s entry lists no workaround; applying the relevant update is the fix.
What to patch now as CISA sets an Outlook deadline
CISA says attackers are exploiting an Outlook flaw that can expose a user’s authentication hash. Federal civilian agencies have a binding deadline; other organizations are urged to prioritize the fix.
What the flaw can expose
A user must open a specially crafted file for the attack to proceed.
The attack requires user action; the Preview Pane is not an attack vector.
It can connect to an attacker-controlled network location without the usual external-content warning.
An attacker could use the NTLMv2 hash to authenticate as the user.
Who must act by the deadline?
CISA’s directive sets different obligations for federal agencies and other organizations.
- BOD 26-04 makes remediation due Nov. 24, 2026.
- Apply vendor mitigations or discontinue use if mitigations are unavailable.
- The federal deadline does not apply.
- CISA urges organizations to prioritize KEV-listed vulnerabilities using risk-based management.
Install the matching Office update
Microsoft lists updates as the fix and provides different builds by product and update channel.
Check the fixed build
The listed fixed build is 16.0.14334.21048, for both 32-bit and 64-bit editions.
Check the fixed build
The listed fixed build is 16.0.17932.21140, for both 32-bit and 64-bit editions.
Match the update channel
Builds differ by channel. Check Microsoft’s release information for each deployment.
Why the Outlook Patch Is Urgent
The risk is not that the flaw automatically runs code or spreads without user involvement: Microsoft rates it Moderate, with a CVSS score of 6.5, and says a user must open a crafted file. The concern is that Outlook can make a network connection without the expected warning, exposing a credential-related hash that an attacker could use to authenticate as the user. That can make the issue relevant to organizations where compromised credentials could provide access to other systems.
For federal civilian agencies, the KEV listing creates a binding remediation deadline. For businesses, schools and other organizations outside that directive, CISA’s recommendation still signals that the flaw deserves prompt attention. Checking the installed Office build is more useful than assuming automatic updates have already reached every device.
Products Worth Considering
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
How CISA’s Deadline Applies
CISA’s Nov. 10 alert added six vulnerabilities to the KEV catalog, including flaws affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium, alongside the Outlook issue. The catalog entry for CVE-2026-124194 names the required action as applying mitigations according to vendor instructions and sets Nov. 24 as the due date.
The directive, identified in the alert as BOD 26-04, applies only to federal civilian executive branch agencies. CISA separately encourages all organizations to use risk-based vulnerability management and prioritize KEV-listed flaws. Microsoft rates this Outlook vulnerability as Moderate; the source material says it was the only issue in Microsoft’s November release marked “Exploitation Detected.” Those ratings do not change CISA’s deadline for agencies covered by the directive.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, in its security update entry for CVE-2026-124194
What Is Not Yet Known
The available information does not identify who is behind the attacks, which organizations or users were targeted, how many may have been affected, or when exploitation began. CISA’s catalog lists use in ransomware campaigns as unknown. The source material also says the vulnerability is not marked for forensic triage under the directive, but that status does not establish whether any particular organization has been compromised.
Microsoft describes the attack mechanics and confirms exploitation, but the material provided does not give incident counts or name victims. CISA’s assessment lists exploitation as active and automatable as no. The interpretation that this may point to targeted messages rather than a rapidly spreading worm is an inference, not a confirmed finding from CISA.
Check Office Builds Before Nov. 24
Federal civilian agencies must meet the Nov. 24 deadline by applying Microsoft’s update or following the directive’s stated course if a mitigation is unavailable. Administrators should check installed versions across Office LTSC and Microsoft 365 Apps deployment channels, then confirm that affected devices have received the relevant fixed build. Microsoft lists different Microsoft 365 Apps builds by channel, so teams should consult the vendor’s release information for the channel each device uses.
Organizations outside the federal directive should weigh CISA’s active-exploitation listing when setting patch priority. The source material does not provide a later deadline for those organizations or further public details about the attacks. Updates to Microsoft’s guidance or CISA’s catalog could clarify additional affected versions, response steps or incident information.
Key Questions
What is CVE-2026-124194?
It is a Microsoft Outlook spoofing vulnerability. Microsoft says opening a specially crafted file can make Outlook connect to an attacker-controlled location without the usual warning, potentially exposing the user’s NTLMv2 hash.
Who must patch by Nov. 24, 2026?
The deadline applies to U.S. federal civilian executive branch agencies under CISA’s BOD 26-04 directive. CISA urges other organizations to prioritize KEV vulnerabilities, but this deadline does not bind them.
What should organizations install?
Microsoft lists Office updates as the fix and says there is no workaround. Administrators should check Microsoft’s release information for the fixed build that matches their Office product and Microsoft 365 Apps update channel.
Does opening an Outlook preview trigger the attack?
Microsoft says the Preview Pane is not an attack vector. Its description says the user must open the malicious file for the attack to proceed.
Who is exploiting the vulnerability?
The source material does not identify the attackers, victims, number of affected organizations or start date of exploitation. CISA lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
