Hackers are exploiting a flaw in Microsoft Outlook that lets them steal users’ password hashes and impersonate them.
Microsoft fixed the flaw, tracked as CVE-2026-124194, in its November Patch Tuesday release on Nov. 10, and said it had detected exploitation. So far, it is the only actively exploited flaw among the more than 1,000 Microsoft fixed this month.
The advisory credits the discovery to a researcher who used Claude to help find the vulnerabilities. It does not say how the flaw was found, or whether it was spotted in an attack already under way.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 10, giving federal agencies until Nov. 24 to patch.
How the attack works
According to Microsoft, an attacker sends a specially crafted message file and convinces the victim to open it. Outlook then connects to an attacker-controlled server without showing its usual external-content warning.
That connection discloses the user’s NTLMv2 password hash to the attacker, “who could use this to authenticate as the user,” Microsoft said. The preview pane is not an attack vector, so the file has to be opened.
Microsoft rated the flaw “Moderate” with a CVSS score of 6.5, and has not shared details of the attacks or who is behind them.
Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, Notebookcheck reported. The fix ships in Office security updates, so the Windows cumulative update alone does not address it, according to CyberInsider.
The flaw is a reminder that stolen NTLM hashes remain a reliable route to impersonating users. Microsoft’s November Windows 11 update also strengthens NTLM, with clients now offering message signing by default to reduce exposure to relay attacks, CyberInsider reported.
