Microsoft patches exploited Outlook spoofing zero day

Microsoft has fixed an actively exploited Outlook zero-day, CVE-2026-124194, as part of the November 2026 Patch Tuesday released on 10 November 2026. The flaw is described as a spoofing vulnerability in which the product UI does not warn users about unsafe actions in Outlook, enabling an unauthorised attacker to perform spoofing over a network. CISA lists exploitation as active in its KEV catalog, and Microsoft notes the CVSS score is 6.5 (Medium) with exploit code maturity rated as High. Microsoft credits Benoit Sevens, who worked with Anthropic’s Claude, and a researcher known as nono for the discovery.

The vulnerability affects Microsoft 365 Apps for Enterprise and certain Office LTSC builds (Office LTSC 2021 before 16.0.14334.21048 and Office LTSC 2024 before 16.0.17932.21140). The attack workflow involves a user opening a crafted message file that causes Outlook to connect to an attacker-controlled network location without the usual external-content warning, allowing the attacker to obtain the user’s NTLMv2 hash and potentially authenticate as the user.

The Preview Pane is not considered an attack vector, and there are currently no published indicators of compromise. Microsoft’s guidance recommends applying the November 2026 Office security updates across all machines running Outlook, verifying that Microsoft 365 Apps update channels have received the fix, and implementing basic mitigations such as blocking outbound SMB and NTLM traffic to the internet. The article notes Microsoft did not disclose targets or attacker details beyond the credited researchers.