# Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)

> Microsoft's November 2026 Patch Tuesday fixed a reported record 1,235 flaws, including one actively exploited zero-day, CVE-2026-124194, a Microsoft Outlook spoofing vulnerability used to steal NTLM account hashes. An unauthenticated attacker can send a crafted message file that makes Outlook connect to an attacker-controlled location without the usual external-content warning; exploitation requires network connectivity and user interaction.

- **Published:** 2026-11-10T19:21:23Z
- **Last reviewed:** 2026-11-11T00:51:33.654Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5673
- **ID:** TL-2026-5673
- **Severity:** HIGH (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 43
- **CVEs:** CVE-2026-124194, CVE-2026-118146, CVE-2026-118148, CVE-2026-118207, CVE-2026-122194, CVE-2026-119969, CVE-2026-120003, CVE-2026-111289, CVE-2026-110043, CVE-2026-111309, CVE-2026-110068, CVE-2026-113825, CVE-2026-113859, CVE-2026-119952, CVE-2026-119962, CVE-2026-119961, CVE-2026-119967, CVE-2026-119958, CVE-2026-118737, CVE-2026-113865, CVE-2026-109459, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964, CVE-2026-119951, CVE-2026-116928, CVE-2026-113752, CVE-2026-124185, CVE-2026-111285, CVE-2026-120005, CVE-2026-118149, CVE-2026-112967, CVE-2026-95962, CVE-2026-119990, CVE-2026-120002, CVE-2026-121662, CVE-2026-121663, CVE-2026-113862, CVE-2026-109467, CVE-2026-120779, CVE-2026-109469, CVE-2026-118740, CVE-2026-113753, CVE-2026-118145, CVE-2026-124227, CVE-2026-124228, CVE-2026-114160, CVE-2026-121680

## Description

Microsoft's November 2026 Patch Tuesday release (November 10, 2026) addressed 1,235 vulnerabilities according to BleepingComputer, which describes it as a record. Roughly 639 are Windows-related. Breakdown by type: 536 Elevation of Privilege, 296 Remote Code Execution, 157 Information Disclosure, 142 Microsoft Edge (Chromium), 46 Denial of Service, 27 Security Feature Bypass and 22 Spoofing (the listed categories sum to 1,226, so nine flaws are not categorized in the article). 66 flaws are rated Critical (48 RCE, 15 EoP and 3 Edge use-after-free). The counts exclude 108 flaws fixed earlier in November (1 Entra Device Registration, 82 Mariner, 25 Edge). The prior release, October 2026 Patch Tuesday, fixed 1,411 flaws including 3 zero-days.

The only flaw reported as a zero-day in this release is CVE-2026-124194, a Microsoft Outlook Spoofing Vulnerability (listed as Moderate severity) that is reported as actively exploited. Per Microsoft's description, an unauthenticated attacker could send a specially crafted message file; when a user opens it, Outlook may connect to an attacker-controlled network location without the usual external-content warning, exposing authentication information. BleepingComputer characterizes this as an NTLM credential disclosure flaw used by attackers to steal NTLM account hashes. Microsoft states that exploitation requires network connectivity and user interaction. Captured NTLMv2 hashes can be cracked offline and may allow impersonation of the user and access to corporate accounts; BleepingComputer notes that similar flaws have previously been exploited through malicious attachments in phishing campaigns. No CVSS score, CWE, discoverer, attribution, victimology or network indicators were published in the reviewed sources.

The release also includes Critical flaws that are not reported as exploited: RCE in Exchange Server (CVE-2026-118207), Microsoft Defender (CVE-2026-122194), Active Directory Domain Services (CVE-2026-118146, plus EoP CVE-2026-118148), Graphic Fonts (CVE-2026-119969), Microsoft Office (CVE-2026-120003, CVE-2026-111289), a dozen Excel RCEs, three additional Outlook RCEs (CVE-2026-110043, CVE-2026-111309, CVE-2026-110068), Word and PowerPoint RCEs, and network-reachable Windows RCEs including Windows SMB Server srvnet.sys (CVE-2026-113825), TCP/IP (CVE-2026-113859), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Message Queuing, LDAP, IIS, RPC Runtime, NAT and Print Spooler. Eight Hyper-V EoP flaws are also rated Critical. Windows 11 cumulative updates KB5132061 and KB5131087 shipped the same day.

Defenders should prioritize the Outlook fix, then Exchange, Defender, AD DS, Office and the network-reachable Windows RCEs, and restrict outbound NTLM/SMB traffic to untrusted destinations. Source caveats: all details derive from BleepingComputer; the MSRC advisory page could not be rendered by the fetch tool (CVSS, CWE and affected builds unverified), the full BleepingComputer report page exceeded the fetch size limit, the CISA KEV feed could not be fully read (CVE-2026-124194 not seen in the portion read), and a web search found no independent corroboration of the CVE identifier at the time of research.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 Malicious File
- T1187 Forced Authentication
- T1212 Exploitation for Credential Access
- T1110.002 Brute Force: Password Cracking
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1210 Exploitation of Remote Services
- T1068 Exploitation for Privilege Escalation
- T1557 Adversary-in-the-Middle
- T1557.001 Adversary-in-the-Middle

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-124194 Outlook Forced NTLM Authentication - OUTLOOK.EXE Outbound SMB to External Host** (`TL-2026-5673-SPL-001`)

Detects OUTLOOK.EXE initiating SMB (TCP 445/139) connections to non-private destinations. This is the core behaviour of the actively exploited Outlook spoofing zero-day CVE-2026-124194 (TL-2026-5673): a user opens a crafted message file (T1204.002, T1566.001) and Outlook reaches an attacker-controlled location without the external-content warning, exploiting the flaw (T1212) to force NTLM authentication and leak the user's NTLMv2 hash (T1187).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1187, T1212, T1566.001, T1204.002
- **Data sources:** sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=3 Initiated=true Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp))
| stats count AS connections min(_time) AS first_seen max(_time) AS last_seen values(DestinationPort) AS dest_ports BY host, User, DestinationIp
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), detection="CVE-2026-124194 Outlook forced NTLM auth (T1187)"
| table first_seen last_seen host User DestinationIp dest_ports connections detection
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139) and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
```

### Sigma

```yaml
title: CVE-2026-124194 Outlook Outbound SMB to External Host
id: 3b1c7a52-5673-4d0e-9a41-0c6e8f2a1b01
status: experimental
description: Detects OUTLOOK.EXE connecting to external hosts on SMB ports, consistent with forced NTLM authentication via CVE-2026-124194 (TL-2026-5673)
references:
    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194
    - https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.t1212
    - attack.execution
    - attack.t1204.002
    - cve.2026-124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    condition: selection and not filter_private
falsepositives:
    - Outlook opening UNC links to partner or cloud-hosted SMB shares
    - Corporate file servers addressed with public IPs
level: high

```

**Known false positives:**

- Outlook opening UNC links to partner or cloud-hosted SMB shares
- Corporate file servers addressed with public IPs reached over VPN or split tunnel

**Tuning notes:** Allowlist known partner or Azure Files destination IPs via a lookup. Requires Sysmon EventID 3 with Outlook in the include rules. IPv6 destinations are not filtered by the cidrmatch exclusion. If SMB egress is already blocked, Windows may fall back to WebDAV over HTTP; add an OUTLOOK.EXE to external TCP 80 hunt using the same structure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Office Application Outbound SMB to Public IP (NTLM Leak Family, CVE-2026-124194 Related) (locked: unlock with TL Creds)
- Successful Network or RDP Logon from Public IP - Possible Cracked NTLMv2 Credential Use (CVE-2026-124194 Aftermath) (locked: unlock with TL Creds)
- Pass-the-Hash Logon Indicators (seclogo Type 9 and NTLM Type 3 with Zero Key Length) (locked: unlock with TL Creds)
- NTLM Logon Fan-Out Across Five or More Hosts in 15 Minutes (Pass-the-Hash Spread) (locked: unlock with TL Creds)
- Firewall Allowed Outbound SMB (445/139) to Public Internet - NTLM Hash Exposure Path (locked: unlock with TL Creds)
- .msg File Written to Download, Temp or Attachment Cache Path (Crafted Message Delivery for CVE-2026-124194) (locked: unlock with TL Creds)
- Outlook Launched with /f Against a .msg File from Download, Temp or Attachment Cache Path (CVE-2026-124194 Delivery) (locked: unlock with TL Creds)
- Office and Outlook Spawning Script or LOLBin Child Process (Outlook/Office RCE Family in November 2026 Patch Tuesday) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day](https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/)
- [Microsoft MSRC advisory CVE-2026-124194 (Outlook Spoofing Vulnerability)](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194)
- [BleepingComputer: Microsoft Patch Tuesday November 2026 full report](https://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Microsoft-Patch-Tuesday-November-2026.html)
- [Microsoft Learn: Zero-day vulnerabilities in Defender Vulnerability Management](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-zero-day-vulnerabilities)
- [BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates released](https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5132061-and-kb5131087-cumulative-updates-released/)
- [BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5673