Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5673 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-124194 Outlook Forced NTLM Authentication - OUTLOOK.EXE Outbound SMB to External Host

Detects OUTLOOK.EXE initiating SMB (TCP 445/139) connections to non-private destinations. This is the core behaviour of the actively exploited Outlook spoofing zero-day CVE-2026-124194 (TL-2026-5673): a user opens a crafted message file (T1204.002, T1566.001) and Outlook reaches an attacker-controlled location without the external-content warning, exploiting the flaw (T1212) to force NTLM authentication and leak the user's NTLMv2 hash (T1187).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1187, T1212, T1566.001, T1204.002
• Data sources: sysmon, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=3 Initiated=true Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp))
| stats count AS connections min(_time) AS first_seen max(_time) AS last_seen values(DestinationPort) AS dest_ports BY host, User, DestinationIp
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), detection="CVE-2026-124194 Outlook forced NTLM auth (T1187)"
| table first_seen last_seen host User DestinationIp dest_ports connections detection

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139) and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType

Sigma

title: CVE-2026-124194 Outlook Outbound SMB to External Host
id: 3b1c7a52-5673-4d0e-9a41-0c6e8f2a1b01
status: experimental
description: Detects OUTLOOK.EXE connecting to external hosts on SMB ports, consistent with forced NTLM authentication via CVE-2026-124194 (TL-2026-5673)
references:
    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194
    - https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.t1212
    - attack.execution
    - attack.t1204.002
    - cve.2026-124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    condition: selection and not filter_private
falsepositives:
    - Outlook opening UNC links to partner or cloud-hosted SMB shares
    - Corporate file servers addressed with public IPs
level: high

Known false positives:

• Outlook opening UNC links to partner or cloud-hosted SMB shares
• Corporate file servers addressed with public IPs reached over VPN or split tunnel

Tuning notes: Allowlist known partner or Azure Files destination IPs via a lookup. Requires Sysmon EventID 3 with Outlook in the include rules. IPv6 destinations are not filtered by the cidrmatch exclusion. If SMB egress is already blocked, Windows may fall back to WebDAV over HTTP; add an OUTLOOK.EXE to external TCP 80 hunt using the same structure.

• 🔒 Office Application Outbound SMB to Public IP (NTLM Leak Family, CVE-2026-124194 Related) · unlock with TL Creds
• 🔒 Successful Network or RDP Logon from Public IP - Possible Cracked NTLMv2 Credential Use (CVE-2026-124194 Aftermath) · unlock with TL Creds
• 🔒 Pass-the-Hash Logon Indicators (seclogo Type 9 and NTLM Type 3 with Zero Key Length) · unlock with TL Creds
• 🔒 NTLM Logon Fan-Out Across Five or More Hosts in 15 Minutes (Pass-the-Hash Spread) · unlock with TL Creds
• 🔒 Firewall Allowed Outbound SMB (445/139) to Public Internet - NTLM Hash Exposure Path · unlock with TL Creds
• 🔒 .msg File Written to Download, Temp or Attachment Cache Path (Crafted Message Delivery for CVE-2026-124194) · unlock with TL Creds
• 🔒 Outlook Launched with /f Against a .msg File from Download, Temp or Attachment Cache Path (CVE-2026-124194 Delivery) · unlock with TL Creds
• 🔒 Office and Outlook Spawning Script or LOLBin Child Process (Outlook/Office RCE Family in November 2026 Patch Tuesday) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 43 indicators of compromise for TL-2026-5673.

Technical analysis

Microsoft's November 2026 Patch Tuesday release (November 10, 2026) addressed 1,235 vulnerabilities according to BleepingComputer, which describes it as a record. Roughly 639 are Windows-related. Breakdown by type: 536 Elevation of Privilege, 296 Remote Code Execution, 157 Information Disclosure, 142 Microsoft Edge (Chromium), 46 Denial of Service, 27 Security Feature Bypass and 22 Spoofing (the listed categories sum to 1,226, so nine flaws are not categorized in the article). 66 flaws are rated Critical (48 RCE, 15 EoP and 3 Edge use-after-free). The counts exclude 108 flaws fixed earlier in November (1 Entra Device Registration, 82 Mariner, 25 Edge). The prior release, October 2026 Patch Tuesday, fixed 1,411 flaws including 3 zero-days.

The only flaw reported as a zero-day in this release is CVE-2026-124194, a Microsoft Outlook Spoofing Vulnerability (listed as Moderate severity) that is reported as actively exploited. Per Microsoft's description, an unauthenticated attacker could send a specially crafted message file; when a user opens it, Outlook may connect to an attacker-controlled network location without the usual external-content warning, exposing authentication information. BleepingComputer characterizes this as an NTLM credential disclosure flaw used by attackers to steal NTLM account hashes. Microsoft states that exploitation requires network connectivity and user interaction. Captured NTLMv2 hashes can be cracked offline and may allow impersonation of the user and access to corporate accounts; BleepingComputer notes that similar flaws have previously been exploited through malicious attachments in phishing campaigns. No CVSS score, CWE, discoverer, attribution, victimology or network indicators were published in the reviewed sources.

The release also includes Critical flaws that are not reported as exploited: RCE in Exchange Server (CVE-2026-118207), Microsoft Defender (CVE-2026-122194), Active Directory Domain Services (CVE-2026-118146, plus EoP CVE-2026-118148), Graphic Fonts (CVE-2026-119969), Microsoft Office (CVE-2026-120003, CVE-2026-111289), a dozen Excel RCEs, three additional Outlook RCEs (CVE-2026-110043, CVE-2026-111309, CVE-2026-110068), Word and PowerPoint RCEs, and network-reachable Windows RCEs including Windows SMB Server srvnet.sys (CVE-2026-113825), TCP/IP (CVE-2026-113859), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Message Queuing, LDAP, IIS, RPC Runtime, NAT and Print Spooler. Eight Hyper-V EoP flaws are also rated Critical. Windows 11 cumulative updates KB5132061 and KB5131087 shipped the same day.

Defenders should prioritize the Outlook fix, then Exchange, Defender, AD DS, Office and the network-reachable Windows RCEs, and restrict outbound NTLM/SMB traffic to untrusted destinations. Source caveats: all details derive from BleepingComputer; the MSRC advisory page could not be rendered by the fetch tool (CVSS, CWE and affected builds unverified), the full BleepingComputer report page exceeded the fetch size limit, the CISA KEV feed could not be fully read (CVE-2026-124194 not seen in the portion read), and a web search found no independent corroboration of the CVE identifier at the time of research.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment

Credential Access

T1110.002 Brute Force: Password Cracking; T1187 Forced Authentication; T1212 Exploitation for Credential Access; T1557 Adversary-in-the-Middle; T1557.001 Adversary-in-the-Middle

Execution

T1203 Exploitation for Client Execution; T1204.002 Malicious File

Lateral Movement

T1210 Exploitation of Remote Services; T1550.002 Use Alternate Authentication Material: Pass the Hash

Remediation

Patches

• Microsoft November 2026 Patch Tuesday cumulative and Office updates (CVE-2026-124194 and others); Windows 11 KB5132061 and KB5131087 per BleepingComputer

Immediate actions

• Deploy the November 2026 Microsoft security updates, prioritizing the Outlook fix for CVE-2026-124194
• Block outbound SMB (TCP 445) and NTLM authentication to the internet and untrusted networks at the perimeter
• Hunt for Outlook processes making outbound connections to external hosts after opening message files
• Reset credentials for any accounts whose NTLM hashes may have been exposed
• Then patch Critical RCEs in Exchange Server, Defender, AD DS, Office and network-facing Windows components

Workarounds

• Block outbound NTLM/SMB at the egress firewall
• Avoid opening message files from untrusted senders until patched

Longer-term hardening

• Reduce or disable NTLM in favor of Kerberos where feasible, with auditing of NTLM usage
• Enforce MFA and monitor for anomalous authentication using NTLM from external sources
• Add Protected Users / SMB signing and egress filtering to limit hash exposure

Affected and fixed versions

• Microsoft — Microsoft Office Outlook
  Vulnerable versions: Versions affected by CVE-2026-124194 not stated in reviewed sources
  Fixed in: November 2026 Outlook/Office security updates
• Microsoft — Exchange Server
  Vulnerable versions: Versions affected by CVE-2026-118207 not stated in reviewed sources
  Fixed in: November 2026 Exchange security update
• Microsoft — Active Directory Domain Services
  Vulnerable versions: Versions affected by CVE-2026-118146 and CVE-2026-118148 not stated in reviewed sources
  Fixed in: November 2026 Windows security updates
• Microsoft — Microsoft Defender
  Vulnerable versions: Versions affected by CVE-2026-122194 not stated in reviewed sources
  Fixed in: November 2026 Defender update
• Microsoft — Windows 11
  Vulnerable versions: 23H2; 24H2; 25H2; 26H2 prior to November 2026 updates
  Fixed in: KB5132061; KB5131087

Timeline

Last updated 2026-11-11 · 7 updates · revalidated 7× · latest source

• 2026-10-13 October 2026 Patch Tuesday fixes 1,411 flaws including 3 zero-days, the baseline preceding the November record release
• 2026-11-04 Microsoft Edge (Chromium-based) CVE-2026-122518 released ahead of Patch Tuesday (listed in the November release notes).
• 2026-11-05 Entra Device Registration Critical EoP CVE-2026-109469 released ahead of Patch Tuesday (listed in the November release notes).
• 2026-11-10 CISA coordinator SSVC v2.0.3 assessment records Exploitation: active, Automatable: no, Technical impact: partial for CVE-2026-124194.
• 2026-11-10 SANS ISC (Johannes Ullrich) diary 33508 summarizes the release as 1,260 vulnerabilities (68 critical, 167 Chromium/Edge), noting CVE-2026-124194 as the only one marked exploited and adding Entra Device Registration (CVE-2026-109469), Aspire (CVE-2026-118740), Hyper-V (CVE-2026-113753) and Function Discovery SSDP (CVE-2026-118145) fixes.
• 2026-11-10 Zero Day Initiative and CyberScoop publish analyses highlighting CVE-2026-116928 (Windows Search via Exchange, zero-click, CVSS 9.8) and CVE-2026-119958 (Windows LDAP, CVSS 9.8); neither is reported exploited.
• 2026-11-10 CISA adds CVE-2026-124194 to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation.
• 2026-11-10 NVD publishes CVE-2026-124194 (CWE-356, CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R) with MSRC and CISA KEV references.
• 2026-11-10 BleepingComputer publishes its Patch Tuesday analysis; no attribution, discoverer, CVSS or network indicators disclosed
• 2026-11-10 Windows 11 cumulative updates KB5132061 and KB5131087 released for 23H2, 24H2, 25H2 and 26H2 alongside Patch Tuesday
• 2026-11-10 Critical network-reachable Windows RCEs patched, including SMB Server srvnet.sys (CVE-2026-113825), TCP/IP (CVE-2026-113859), Schannel (CVE-2026-119952) and CredSSP (CVE-2026-119962)
• 2026-11-10 Three additional Critical Outlook RCEs (CVE-2026-110043, CVE-2026-111309, CVE-2026-110068) patched; not reported exploited
• 2026-11-10 Critical RCE fixes shipped for Exchange Server (CVE-2026-118207), Microsoft Defender (CVE-2026-122194), AD Domain Services (CVE-2026-118146), Graphic Fonts (CVE-2026-119969) and Office (CVE-2026-120003, CVE-2026-111289)
• 2026-11-10 CVE-2026-124194 (Outlook Spoofing Vulnerability, rated Moderate) is reported as actively exploited to steal NTLM account hashes; it is the only zero-day in the release
• 2026-11-10 Microsoft releases November 2026 Patch Tuesday updates fixing a reported record 1,235 flaws, 66 rated Critical
• 2026-11-11 End of servicing takes effect for .NET 8 LTS, PowerShell 7.4 LTS and Windows 11 23H2 Enterprise/Education/IoT Enterprise editions (per Rapid7).
• 2026-11-24 CISA KEV federal remediation due date for CVE-2026-124194; required action: apply vendor mitigations and follow BOD 26-04 and Forensics Triage Requirements guidance.
• 2026-12-08 Next scheduled Microsoft Patch Tuesday, per Qualys.

Update history

• 2026-11-11 — Microsoft November 2026 Patch Tuesday: Exploited Outlook Spoofing Zero-Day (CVE-2026-124194) and 63 Critical Vulnerabilities: What changed No field escalations: severity HIGH, exploitability ACTIVE, status ACTIVE and CVSS 6.5 are already recorded.
• 2026-11-11 — Microsoft November 2026 Patch Tuesday: 1,093 CVEs incl. exploited Outlook spoofing zero-day (CVE-2026-124194): What changed No severity, exploitability or status change; existing values (HIGH, ACTIVE, CVSS 6.5) already match the newer report. New indicators (4) Indicator values are withheld at this access level.
• 2026-11-10 — Microsoft Patch Tuesday November 2026 - 1,260 vulnerabilities, Outlook spoofing CVE-2026-124194 exploited: What changed No severity, exploitability, status or CVSS change. CVE-2026-124194 remains the sole exploited flaw; existing record already ACTIVE/6.5. New indicators (4) Indicator values are withheld at this access level.
• 2026-11-10 — Microsoft Patch Tuesday November 2026 - Outlook NTLMv2 hash-leak spoofing zero-day (CVE-2026-124194) exploited in the wild: What changed No field escalation: severity, exploitability, CVSS 6.5 and status are already reflected in the existing record. The update is purely additive context. New indicators (6) Indicator values are withheld at this access level.
• 2026-11-10 — November 2026 Patch Tuesday: Outlook NTLMv2 spoofing zero-day (CVE-2026-124194) exploited, plus critical Exchange, SharePoint, Windows Search and LDAP flaws: What changed No escalation: severity HIGH, exploitability ACTIVE, status ACTIVE, CVSS 6.5 are unchanged.
• 2026-11-10 — Microsoft November 2026 Patch Tuesday: ~1,094 CVEs fixed, Outlook spoofing zero-day CVE-2026-124194 actively exploited (NTLMv2 hash leak), Windows Search/Exchange RCE CVE-2026-116928 and LDAP RCE CVE-2026-119958: What changed No severity, exploitability, status or CVSS change. CVE-2026-124194 remains the only exploited flaw (CVSS 6.5, ACTIVE).
• 2026-11-10 — Microsoft Patch Tuesday November 2026 – Exploited Outlook Spoofing Zero-Day (CVE-2026-124194) and Critical Windows/Office RCEs: What changed CVSS score set to 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and CWE-356 recorded per NVD. Exploitability already ACTIVE; now corroborated by a CISA KEV listing (added 2026-11-10, due 2026-11-24).

Sources cited

• Microsoft MSRC advisory CVE-2026-124194 (Outlook Spoofing Vulnerability) Microsoft Security Response Center · Advisory · 2026-11-10
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-10
• BleepingComputer: Microsoft Patch Tuesday November 2026 full report BleepingComputer · Research · 2026-11-10
• Microsoft Learn: Zero-day vulnerabilities in Defender Vulnerability Management Microsoft · Vendor report · 2026-11-10
• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day BleepingComputer · News · 2026-11-10
• BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates released BleepingComputer · News · 2026-11-10
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days BleepingComputer · News · 2026-10-13

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Related coverage of this activity

• Outlook NTLMv2 hash leak zero-day
• CVE-2026-124194 Outlook zero-day

Other reports on CVE-2026-124194

• Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning

Previous and next in vulnerability

• SSHole (CVE-2026-123158) - OpenSSH on musl-based Linux oversized password authentication bypass, exploited in the wild Previous report