CISA Flags Exploited Outlook Spoofing and NTLMv2 Disclosure Vulnerability
Tech GuruQuick Answer
Install the November 10 Office security update for each affected product and channel, then restart Outlook. Review suspicious message-file openings and outbound authentication activity, and retain endpoint and identity evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Office product, architecture, release channel, complete build, update policy and endpoint owner. Match the six MSRC product rows. Exploitation requires opening a malicious file, user interaction and network connectivity; the Preview Pane is not the attack vector. Deploy the November 10 security update for the installed product and channel. Use the official build table, including the exact LTSC builds below; verify the update is running after restart. Confirm installed and running Office builds, test mail and sign-in workflows, and review unexpected outbound authentication or subsequent account activity.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Outlook in Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024, 32-bit and 64-bit |
|---|---|
| Advisory | CVE-2026-124194 / CISA-KEV-CVE-2026-124194 |
| CVE | CVE-2026-124194 |
| CISA KEV addition and catalog release | November 10, 2026 (KEV addition); catalog released at 2026-11-10T19:03:29.837500Z. |
| Authority revision date | Microsoft initially published and last revised this advisory November 10, 2026 at 16:00 UTC. |
| Affected versions | The six Microsoft product rows cover Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 in both architectures. Validate the installed channel and build against the November 10 update table; do not infer a universal affected build range. |
| Fixed version | November 10, 2026 Office security updates for the installed channel; LTSC 2024 16.0.17932.21140; LTSC 2021 16.0.14334.21048 |
| CVSS base score | 6.5 (Microsoft CVSS v3.1 base score) |
| CVSS severity | Moderate (Microsoft severity; CVSS severity not provided) |
| Exploitation status | Microsoft reports Exploitation Detected; CISA confirms exploitation through KEV. Ransomware campaign use is Unknown.; no exploitation claim is inferred. |
What Changed
Microsoft reports detected exploitation and CISA added this Outlook flaw to KEV. Opening a crafted message file can connect to an attacker-controlled network location without the usual warning and disclose an NTLMv2 hash. Microsoft states that the Preview Pane is not an attack vector.
What To Validate Now
- Inventory. Record Office product, architecture, release channel, complete build, update policy and endpoint owner.
- Establish applicability. Match the six MSRC product rows. Exploitation requires opening a malicious file, user interaction and network connectivity; the Preview Pane is not the attack vector.
- Remediate. Deploy the November 10 security update for the installed product and channel. Use the official build table, including the exact LTSC builds below; verify the update is running after restart.
- Validate. Confirm installed and running Office builds, test mail and sign-in workflows, and review unexpected outbound authentication or subsequent account activity.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve suspicious messages, endpoint telemetry and identity logs without distributing credential material. CISA lists November 24, 2026 as the due date and forensic triage No; follow applicable directive and response requirements.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
- First-party evidence 1
- First-party evidence 2
- First-party evidence 3
- First-party evidence 4
- First-party evidence 5
November 10 Fixed Builds By Channel
| Microsoft 365 Current Channel 2610 | 20527.20196 |
|---|---|
| Monthly Enterprise 2610 / 2609 / 2608 | 20527.20194 / 20430.20264 / 20326.20320 |
| Semi-Annual Enterprise receiving Monthly Enterprise builds, 2610 / 2609 / 2608 | 20527.20192 / 20430.20262 / 20326.20318 |
| Office LTSC 2024 / LTSC 2021 | 17932.21140 / 14334.21048 |
