Vulnerabilities

November Patch Tuesday: exploited Outlook zero-day leaks NTLM hashes

Microsoft’s November Patch Tuesday fixes 1,000+ flaws, including CVE-2026-124194, an exploited Outlook bug that leaks NTLMv2 hashes. Patch Office now.

Warning symbol over an email inbox illustrating the exploited Outlook zero-day patched in Microsoft's November 2026 Patch Tuesday

Microsoft’s November 2026 Patch Tuesday closes more than 1,000 vulnerabilities, and one of them, an Outlook flaw that hands attackers a user’s NTLMv2 hash, is already being used in real attacks. It carries only a moderate 6.5 score, which is exactly why UK patch teams risk leaving it in the queue.

What happened

On Tuesday 10 November Microsoft shipped its eleventh monthly security release of the year. Tenable counts 1,093 CVEs, with 63 rated critical, 1,029 important and a single moderate entry; CSO Online and CyberInsider put it at 1,094, and the totals include CVEs Microsoft republished for third-party code such as Chromium, OpenSSH and the Linux kernel. Elevation of privilege bugs make up almost half of the total, with remote code execution a little over a quarter.

The one that matters most this morning is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Microsoft says it has seen it exploited in the wild, although it had not been publicly disclosed before the fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on the same day, giving federal agencies until 24 November to remediate.

The advisory credits a researcher known as nono together with Anthropic’s Benoît Sevens, working with the Claude model. Microsoft has shared nothing about who is exploiting the bug, against whom, or at what scale.

The vulnerable software covers Microsoft 365 Apps for Enterprise plus the 2021 and 2024 releases of Office LTSC. Rapid7 notes that every supported version of classic Outlook receives a patch.

The technical picture

The weakness sits in how Outlook handles a specially crafted message or Office file. When a recipient opens it, Outlook can reach out to a network location controlled by the attacker and, crucially, does so without the warning that normally appears before external content is fetched. Microsoft’s own description boils down to a user interface that fails to alert the user to an unsafe action.

That silent connection is enough to leak the victim’s NTLMv2 challenge-response hash. The hash can be relayed in real time to another service that still accepts NTLM, letting the attacker sign in as the user wherever protections such as SMB or LDAP signing and Extended Protection for Authentication are absent. Alternatively it can be taken offline and cracked, which recovers the actual password if it is weak enough.

There are two limiting factors. The user has to open the file; Microsoft says simply previewing the message in the Preview Pane will not trigger it. And the fix arrives through Office security updates, not the Windows cumulative update, so a machine showing as fully patched for Windows can still be exposed.

The rest of the release is far from quiet. Tenable highlights critical remote code execution flaws in Active Directory Domain Services (CVE-2026-118146), Exchange Server (CVE-2026-118207), Windows Schannel (CVE-2026-119952, exploitable without authentication under specific conditions) and Windows NAT (CVE-2026-113862), all assessed as more likely to be exploited. A SharePoint Server privilege escalation (CVE-2026-120002) scores 9.9. Several Windows network services, including LDAP (CVE-2026-119958) and Kerberos (CVE-2026-85844), carry 9.8 bugs that need no login, putting domain controllers firmly in scope.

Alongside the fixes, the Windows 11 November update (KB5132061) now has clients offer NTLM message signing by default on non-anonymous connections, with new auditing to show which connections are not signed. That is a welcome, if partial, defence against exactly the relay scenario this zero-day enables.

Flow diagram showing how the Outlook zero-day CVE-2026-124194 leads from a crafted file to a leaked and relayed NTLMv2 hash

Why it matters for UK organisations

Outlook, Microsoft 365 and on-premises Active Directory are the backbone of most UK businesses, councils, schools, NHS trusts and charities. Many of those estates still carry NTLM somewhere: legacy file shares, older print and scan devices, and internal apps that never moved to Kerberos. Every one of those is a potential destination for a relayed hash.

The severity score creates a quieter problem. Cyber Essentials requires updates to be applied within 14 days where they fix vulnerabilities the vendor rates critical or high risk, or that carry a CVSS v3 score of 7 or above. Microsoft rates this flaw Moderate with a score of 6.5, so it may not trigger that rule on its own, and plenty of UK patch policies are built around the same threshold. A flaw that is being exploited today could therefore sit untouched until the next routine Office cycle in organisations that follow their policy to the letter.

The credential angle also matters for regulatory exposure. A stolen and replayed identity that reaches personal data could well be a breach reportable to the ICO under UK GDPR, and any investigation is likely to ask why a known exploited flaw was left unpatched.

Expert view

In my experience, captured NTLM hashes are one of the most reliable ways to move from a single phished user to something far more valuable. On internal tests, hash capture and relay remains a routine finding, usually because signing is not enforced end to end and nobody has a complete map of where NTLM is still in use. This zero-day removes the need for the attacker to be on the network at all: the victim’s own mail client does the work.

Nightwing’s Nick Carroll put it plainly to CSO Online: “Don’t let the low score fool you.” I agree. CVSS measures the flaw in isolation, not the chain it enables. Rapid7 notes that the bug suits both bulk initial access campaigns and targeted operations.

The AI credit is notable too. Tenable’s Satyam Narang observed that AI has mostly been adding volume to Patch Tuesday this year, and that this looks like the first time it has found a genuine needle, in other words a bug attackers were already using. Volumes like these make prioritisation by exploitation and exposure, not raw score, the only workable approach.

What to do now

  1. Deploy the Office updates for CVE-2026-124194 immediately, treating it as critical regardless of its score. Verify Microsoft 365 Apps channels and Office LTSC builds separately from Windows patch compliance (Cyber Essentials: security update management).
  2. Block outbound SMB (TCP 445) and NTLM to the internet at the perimeter and on endpoints, so a hash cannot leave the network in the first place (Cyber Essentials: firewalls).
  3. Enforce SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication on Exchange and AD Certificate Services to blunt relay attempts (Cyber Essentials: secure configuration).
  4. Audit NTLM use with the new Windows auditing and existing NTLM event logging, then plan to restrict it. Add privileged accounts to the Protected Users group.
  5. Patch domain controllers and Exchange next, followed by anything exposing LDAP, Kerberos, Schannel or other network services to untrusted networks.
  6. Hunt for signs of abuse: unexpected outbound SMB or WebDAV connections from Outlook, and sign-ins from unusual hosts shortly after users open attachments. Reset passwords for any users who show those patterns and enforce MFA (Cyber Essentials: user access control).

Bottom line

November’s release is huge, but the most urgent fix is also one of the lowest scored. An exploited Outlook bug that quietly leaks credentials deserves the same treatment as any critical, and UK organisations should patch Office now, close off outbound NTLM, and use this as the push to finally retire NTLM where they can.

Sources

Related Posts