Introduction
Since November 10, 2026, a zero-day vulnerability under active exploitation has been targeting multiple versions of Microsoft Office. Opening a crafted message file is enough to silently transmit the user's NTLMv2 hash to an attacker, no prompt, no warning dialog, no additional interaction required. Tracked as CVE-2026-124194, immediately added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and confirmed as actively exploited in the wild, this flaw is a stark reminder that NTLM remains a persistent attack vector in Microsoft environments, even after years of deprecation efforts.
A Zero-Friction Attack Path
The mechanism is deceptively straightforward. An attacker sends a specially crafted message file to their target. The moment the recipient opens it in a vulnerable version of Outlook, the client automatically initiates an outbound connection to an attacker-controlled server, no confirmation prompt, no security banner, nothing. That connection carries the NTLMv2 hash of the active session.
One partial mitigating factor: the vulnerability cannot be triggered from the Preview Pane. Full file opening is required. That constraint does narrow the exposure window slightly, but it offers cold comfort in any organization where employees routinely open email attachments as part of their daily workflow.
From Captured Hash to Network Compromise
A stolen NTLMv2 hash gives an attacker two distinct paths forward. The first is NTLM relay: the hash is forwarded in real time to other internal services, allowing the attacker to authenticate as the victim without ever cracking the password. The second is offline cracking: specialized tooling can recover the plaintext password directly from the hash.
In an Active Directory environment, the blast radius extends well beyond a single compromised inbox. Even a moderately privileged account can open doors to sensitive file shares, RPC services, or domain controllers, depending on network topology and trust boundaries.
Affected Products and Remediation Timeline
CVE-2026-124194 affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, in both 32-bit and 64-bit editions. Its CVSS score sits at 6.5, rated "Moderate", but CISA has set a hard remediation deadline of November 24, 2026 for U.S. federal agencies. In practice, it is that compressed timeline, not the severity score, that makes this the top patching priority of the November cycle. The fix has been available since November 10 via Windows Update and the Microsoft Update Catalog.
What the Patch Alone Won't Fix
This vulnerability doesn't exist in a vacuum. Microsoft has been progressively deprecating NTLM in favor of modern authentication protocols for several years: Windows 11 now enables NTLM message signing by default for non-anonymous connections, reducing relay risk. Kerberos remains the recommended protocol for any controlled enterprise environment.
And yet, millions of endpoints and line-of-business applications continue to negotiate via NTLM, either because migrations are incomplete or because legacy applications still can't support Kerberos. CVE-2026-124194 makes the point bluntly: as long as NTLM remains active in your environment, any component capable of initiating a network connection, email clients, mapped drives, UNC paths, represents a latent attack surface.
Applying the November patch is non-negotiable. But enabling Enhanced Protection for Authentication (EPA) and auditing residual NTLM configurations is what actually closes the door for good.