Microsoft released a fix on November 10, 2026, for an actively exploited Outlook spoofing zero-day tracked as CVE-2026-124194. The flaw can expose a user's NTLMv2 authentication hash when the user opens a crafted message file, according to Microsoft's advisory as reported by BleepingComputer. The company included the fix in its November security updates, making organizations that use affected Outlook versions a priority for patch deployment.

The issue was one of the most urgent items in a broad Patch Tuesday release covering Microsoft software. Tenable counted 1,093 CVEs in the release, including 63 it classified as critical; other publications used different counting methods. Tenable and Dark Reading both identified CVE-2026-124194 as the only flaw in the release that Microsoft said was already exploited before a fix was available.

Microsoft said an unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Outlook. Opening the file can make Outlook connect to a network location controlled by the attacker without the usual warning for external content. The attack requires network access and user interaction, according to the Microsoft description reproduced by BleepingComputer.

That connection can disclose authentication information, including an NTLMv2 hash. Tenable said an attacker who obtains the hash may be able to impersonate the user in a subsequent attack. The advisory describes a spoofing and credential exposure path, rather than remote code execution. Microsoft rated the vulnerability moderate, with a CVSS score of 6.5, despite the confirmed exploitation.

Microsoft has not publicly identified the attackers, the number of affected organizations, or specific indicators of compromise in the cited advisory and reporting. Administrators should use the Microsoft Security Update Guide to identify applicable Outlook updates and verify that they reach affected endpoints. Dark Reading also highlighted separate Exchange and SharePoint flaws in the release, so patch plans should account for those products where deployed.

Security teams can prioritize CVE-2026-124194 because exploitation has been reported, then review the remaining November fixes against their installed Microsoft products. They should investigate suspicious Outlook message files and unexpected outbound authentication to untrusted network locations where relevant telemetry is available. Those checks follow from the published attack mechanism; they are not evidence that any particular organization was compromised.