An Outlook message file can send Windows authentication material off the device before the user sees the usual warning. Microsoft confirmed exploitation on November 10, 2026.
Last verified November 10, 2026 (UTC).
What changed and who is affected
Microsoft rates CVE-2026-124194 Moderate, CVSS 3.1 6.5, and marks exploitation detected. A user must open a malicious file in an affected Outlook client with network connectivity. The Preview Pane is outside the documented attack path. MSRC lists Windows desktop Microsoft 365 Apps for enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. It gives no separate lower affected build or CVE-specific workaround. CISA added CVE-2026-124194 to KEV on November 10, 2026. November 24, 2026 is the federal deadline. The fixed builds and patch priority below are unchanged.
Fixed Office builds
Office LTSC 2021 16.0.14334.21048 and 2024 16.0.17932.21140. Microsoft 365 Apps Current 2610 20527.20196. Monthly Enterprise 2610 20527.20194, 2609 20430.20264, and 2608 20326.20320. Semi-Annual Enterprise 2610 20527.20192, 2609 20430.20262, and 2608 20326.20318.
Suggested MSP priority: urgent
Inventory Outlook and the installed Office build and update channel, then expedite the matching Office update and verify the running build after restarting Office. Prioritize privileged users and devices with NTLM exposure. Restrict unnecessary outbound authentication paths where compatible as a temporary containment measure. If exposure is suspected, preserve email and endpoint/network telemetry, investigate unusual NTLM and subsequent sign-ins, and coordinate a targeted credential reset if compromise is indicated. MSRC publishes no CVE-specific indicators or blanket rotation requirement in the reviewed release.
Official sources
MSRC CVE-2026-124194 · Microsoft November CVRF · Microsoft Office security builds · CISA KEV
November 10, 2026 update. Added CISA’s KEV listing and federal deadline. Official CISA catalog data.