MicrosoftAnalysisMicrosoft patches actively exploited zero-day Outlook NTLM hash theft vulnerability
What happened.Microsoft addressed an actively exploited zero-day spoofing vulnerability in Outlook during its monthly security update cycle.
Why it matters.Desktop email clients serve as standard workspace hubs across corporate environments. When opening a file triggers silent background authentication without user consent, attackers harvest password hashes to access internal corporate networks. System administrators must deploy monthly Office patches across all enterprise endpoints. Security operations teams should block outbound SMB port 445 traffic at the network perimeter.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-124194 with a 6.5 CVSS score, the defect stems from missing user interface warnings during unsafe file actions in classic Outlook.
- Attack vector: Unauthenticated remote attackers trick users into opening crafted files, prompting Outlook to silently open connections to remote network shares.
- Credential exposure: The automated SMB negotiation leaks the user Windows NTLMv2 password hash to external servers for offline cracking or credential relay.
- Federal directive: The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04.
- Remediation releases: Microsoft published security updates across Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021.