CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploit...

cve · CVE-2026-124194

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Outlook zero-day CVE-2026-124194 exploited: a crafted message file leaks authentication data; install the…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-124194, newest first. Check the date before acting on an older one.

  • Install the November 2026 Office updates on every Outlook installation now (Office LTSC 2024 to 16.0.17932.21140, Office LTSC 2021 to 16.0.14334.21048, Microsoft 365 Apps through its update channel), then check proxy and firewall logs back to the earliest message-file delivery you can find for Outlook connections to external SMB, WebDAV or HTTP destinations, and reset the accounts of any user whose session authenticated to one.
    2026-11-11CVE-2026-124194

Defender insights

What each entry about CVE-2026-124194 tells a defender to do, newest first.

2026-11-11HIGHexploitedOutlook zero-day CVE-2026-124194 exploited: a crafted message file leaks authentication data; install the Office update

Exposure · triage · detection

Story timeline

  1. 2026-11-11CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploited as a zero-day, fixed in the November 2026 updates and listed by CISA (CVSS 3.1 6.5)
    trending-vulnerabilitiesOutlook zero-day CVE-2026-124194 exploited: a crafted message file leaks authentication data; install the Office update

Hunting pivots

Affected products
Microsoft 365Microsoft Outlook
Tags
actively-exploitedcisa-kevinfo-disclosurepatch-availablevulnerabilitieszero-day
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessPhishing: Spearphishing Attachment
  • ExecutionUser Execution: Malicious File
  • Credential AccessForced Authentication

Initial Access TA0001

T1566.001Phishing: Spearphishing Attachment×1

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-11-11/cve-2026-124194-outlook-forced-authentication-exploited-kev · ATT&CK page ↗

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-11-11/cve-2026-124194-outlook-forced-authentication-exploited-kev · ATT&CK page ↗

Credential Access TA0006

T1187Forced Authentication×1

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information.

Evidence: 2026-11-11/cve-2026-124194-outlook-forced-authentication-exploited-kev · ATT&CK page ↗

Entries about CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploit... (1)

2026-11-11 · view entry permalink →

HIGHCVE-2026-124194exploitedNATOA1

CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploited as a zero-day, fixed in the November 2026 updates and listed by CISA (CVSS 3.1 6.5)

Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CWE-356, the product does not warn the user of an unsafe action) scored CVSS 3.1 6.5, which the Security Update Guide marks as exploited and not publicly disclosed (Microsoft, 2026-11-10). Microsoft's FAQ says an unauthenticated attacker sends a crafted message file and convinces the user to open it, whereupon Outlook may connect to an attacker-controlled network location without showing the usual external-content warning, "potentially disclosing authentication information that could be used to impersonate the user"; the Preview Pane is not an attack vector, so the file has to be opened (Microsoft, 2026-11-10). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10), and BleepingComputer counts it as the one actively exploited zero-day of this Patch Tuesday (BleepingComputer, 2026-11-10). The affected products are Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 (fixed in 16.0.17932.21140) and Office LTSC 2021 (fixed in 16.0.14334.21048); Microsoft 365 Apps take the fix through the Office security-update channel (ENISA EUVD, 2026-11-10). BleepingComputer calls it an NTLM credential disclosure flaw: opening the attachment makes Windows connect to an attacker-controlled share and expose the user's NTLMv2 hash, which can be captured and cracked offline (BleepingComputer, 2026-11-10). No source names the actor or the victims.

Triage: Outlook legitimately contacts SharePoint, OneDrive and corporate file servers; the discriminator is an external, non-corporate destination preceded by the opening of a message file.

Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.

Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

Microsoft

Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

CISA 2026-11-10
vulnerability11 Nov 03:37Zmulti-sourceOpen finding →
Sources: Microsoft (Security Update Guide) · ENISA EUVD (Microsoft CNA record) · CISA · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (25%)
  • cisa.gov1 (25%)
  • euvdservices.enisa.europa.eu1 (25%)
  • msrc.microsoft.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)