Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes

Microsoft has confirmed that hackers are exploiting an Outlook zero-day that can expose Windows authentication information when a user opens a malicious file.

Tracked as CVE-2026-124194, the spoofing vulnerability was patched on November 10, 2026. Microsoft marks it “Exploitation Detected” and says it was not publicly disclosed before the update.

The flaw carries a CVSS score of 6.5 and a Moderate severity rating. However, confirmed attacks make it a patching priority. Microsoft’s Exploitability Index states that “Exploitation Detected” means the company knows of actual exploitation, not just that attackers could develop a working exploit.

Outlook 0-Day Vulnerability

An attacker does not need an account or prior access to the target’s system. Instead, they send a specially crafted message file and convince the recipient to open it in an affected Outlook version. Successful exploitation requires both user interaction and network connectivity.

Opening the file can cause Outlook to connect to a network location controlled by the attacker without showing its usual external-content warning. Microsoft classifies the underlying weakness as CWE-356, where a product’s interface fails to warn users about unsafe actions. The missing warning removes an important chance to stop the connection.

Microsoft explicitly states that the Preview Pane is not an attack vector. Simply previewing a message does not meet the documented exploitation requirements. That separates this flaw from earlier Outlook attacks covered in Cybersecuritynews.com’s report on Russian hackers exploiting Outlook, which involved a different vulnerability requiring no user action.

According to Microsoft’s advisory, successful exploitation discloses the user’s NTLMv2 hash, potentially allowing an attacker to authenticate as that user. This is authentication-data theft, not evidence that the flaw directly runs malicious code. Microsoft rates confidentiality impact as High, with no direct integrity or availability impact.

NTLM-related leaks can support follow-on attacks, depending on the receiving service’s protections. Microsoft’s earlier Outlook investigation documented authentication relay and offline password cracking as possible uses of captured Net-NTLMv2 data.

Cybersecuritynews.com’s coverage of compromised Ubiquiti routers shows how attackers previously used external infrastructure for credential theft. Those historical details do not establish attribution for this new campaign.

Affected Versions

Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, across 32-bit and 64-bit editions. Microsoft lists fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Administrators should deploy the applicable Office security updates promptly.

As added protection, Microsoft recommends blocking unnecessary outbound SMB traffic on TCP port 445 to the internet. This limits external SMB exposure but does not replace installing the Outlook fix.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes appeared first on Cyber Security News.