Outlook Zero-Day CVE-2026-124194 Leaks a Login Hash When a Crafted Message Is Opened. A Public PoC Exists and Was Never Tested
Install the November Microsoft Office updates, and block outbound SMB at your network edge. Microsoft's November 10 security update fixes CVE-2026-124194, an Outlook flaw Microsoft itself marks as exploited. A crafted message makes Outlook connect to an attacker's server without the usual warning, which can hand over a hash of the user's Windows login. CISA added it to its Known Exploited Vulnerabilities catalog on November 10 with a federal deadline of Tuesday, November 24.
What has been reported
The primary source for the details below is The Hacker News report of November 11 on Microsoft's Patch Tuesday, which an agent read for us. We did not read Microsoft's own advisory page and quote Microsoft only as The Hacker News does.
- The flaw: Microsoft's description, per The Hacker News, is that Outlook's interface does not warn users of an unsafe action. An attacker with no access sends a crafted message file and persuades the target to open it. Outlook then connects to a network location the attacker controls without the normal external-content warning. That can disclose an NTLMv2 hash, a credential response an attacker can use to impersonate the user. Severity is 6.5 out of 10, rated Moderate, and Microsoft says user interaction is required.
- Exploitation: Microsoft flags it as actively exploited and, per The Hacker News, has not attributed the activity to any actor or given technical details. Two reporters are credited; The Hacker News says one is from Anthropic and used Claude.
- Preview Pane: the article does not say whether viewing a message in the preview pane is enough. Microsoft's wording as quoted says "open it." We do not know, so do not assume the preview pane is safe.
- A public proof-of-concept: our exploit harvester logged a GitHub repository for this CVE on November 11 at 06:01 UTC. An agent read its README and two of its code files for us. The author's own description says it is a concept proof that was never tested against a vulnerable Outlook. It builds a message file with a network path planted in a message property, and includes a listener for port 445 that prints a captured hash. The agent found no downloader, hidden code or binaries in the files it read, and our reading of the listener (the agent's reading, untested) is that it sends a fixed reply rather than a real challenge, so it would likely not capture a crackable hash from a real client. The repository has no stars and two commits. We read two of seven files fully and are not describing the rest. We do not name the repository: it is a ready-made lure generator.
What it means
The flaw is old in shape: get Windows to authenticate to a server you run, then use or crack what you receive. What is new is that opening a message is the trigger and the warning that should stop it is missing. The captured hash is a credential, so a single user opening one message can turn into access to anything that accepts that user's Windows login.
What to do
- Apply the November Microsoft 365 Apps and Office updates. The repository's author lists fixed builds for Microsoft 365 Apps and Office LTSC, but we could not confirm those build numbers against Microsoft, so take them from Microsoft's own page.
- Block outbound SMB, TCP port 445, from user networks to the internet. This is the control that makes the stolen-hash trick fail even on an unpatched machine.
- Tell staff not to open unexpected message files attached to email, and treat this week's unexpected ones as suspect.
- If you think a user opened one, reset that user's password and look for sign-ins from unfamiliar places.
What is not known
Who is exploiting it and how widely. Whether the preview pane triggers it. Whether the public repository works at all. We found no second PoC and have not seen exploitation ourselves.
How we know, and how we checked
We read The Hacker News's report and the public repository's README and two code files through an agent. We ran nothing. Our edge check cannot see this: the trigger is a message opened on a user's computer, not a request to a web path. We add no indicators to our feed: none are published.
Sources
The Hacker News, "Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes," November 11, 2026. CISA Known Exploited Vulnerabilities catalog, entry added November 10, 2026. A public GitHub repository for CVE-2026-124194, read November 11, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.