CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploited as a zero-day, fixed in the November 2026 updates and listed by CISA (CVSS 3.1 6.5)

Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CWE-356, the product does not warn the user of an unsafe action) scored CVSS 3.1 6.5, which the Security Update Guide marks as exploited and not publicly disclosed (Microsoft, 2026-11-10). Microsoft's FAQ says an unauthenticated attacker sends a crafted message file and convinces the user to open it, whereupon Outlook may connect to an attacker-controlled network location without showing the usual external-content warning, "potentially disclosing authentication information that could be used to impersonate the user"; the Preview Pane is not an attack vector, so the file has to be opened (Microsoft, 2026-11-10). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10), and BleepingComputer counts it as the one actively exploited zero-day of this Patch Tuesday (BleepingComputer, 2026-11-10). The affected products are Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 (fixed in 16.0.17932.21140) and Office LTSC 2021 (fixed in 16.0.14334.21048); Microsoft 365 Apps take the fix through the Office security-update channel (ENISA EUVD, 2026-11-10). BleepingComputer calls it an NTLM credential disclosure flaw: opening the attachment makes Windows connect to an attacker-controlled share and expose the user's NTLMv2 hash, which can be captured and cracked offline (BleepingComputer, 2026-11-10). No source names the actor or the victims.

Triage: Outlook legitimately contacts SharePoint, OneDrive and corporate file servers; the discriminator is an external, non-corporate destination preceded by the opening of a message file.