A vulnerability in Microsoft Outlook could potentially expose the authentication information of Windows users. This vulnerability, identified as CVE-2026-124194, was already being exploited by attackers before Microsoft released fixes on Tuesday (the 10th).
This issue allows intruders to obtain the NTLMv2 authentication hash, which can then be used in attempts to access systems and accounts by impersonating a legitimate user. To exploit this flaw, an attacker must convince the victim to open a specially prepared message file.
Microsoft classified this vulnerability as moderate, but confirmed active instances of its use. Furthermore, the US Cybersecurity and Infrastructure Security Agency (CISA) included this vulnerability in its catalog of known exploited vulnerabilities.
The fix was released on Tuesday (the 10th) as part of Microsoft's monthly security update package, known as Patch Tuesday. The company confirmed that CVE-2026-124194 was exploited prior to the patch's availability. The vulnerability was defined as a spoofing error with a CVSS score of 6.5, which measures the severity of digital security issues.
The official advisory states that affected products include Microsoft 365 Apps for Enterprise, as well as Office LTSC 2021 and Office LTSC 2024 versions. The discovery was attributed to researchers named Nono and Benoît Sevens. According to Microsoft, Sevens utilized Claude, an artificial intelligence (AI) model from Anthropic, during the vulnerability analysis process.
CISA also added this flaw to its catalog of known exploited vulnerabilities, known as KEV. The agency set a deadline of November 24, 2026, for US federal civilian agencies to apply the fix. This requirement is directed at American institutions, not Brazilian companies.
The Outlook vulnerability is part of a larger set of updates provided by Microsoft in November. According to the analysis, the package includes 1,259 fixes and vulnerability identifiers. Of this total, 1,094 relate to Microsoft's own product flaws, while 165 other identifiers were published based on third-party reports.
Among the covered products are Windows and Office. The package contains 726 fixes related to Windows and 174 related to Office, in addition to over 500 privilege escalation vulnerabilities—a situation where an attacker gains higher permissions than intended in a specific system. The update also addresses errors that could allow remote code execution in Windows components, and a privilege escalation vulnerability in Azure OpenAI.
This marks the second consecutive month that Microsoft's monthly security package has exceeded one thousand vulnerabilities. The article about the Outlook breach first appeared on the Olhar Digital portal.
