Microsoft patches an exploited Outlook flaw that leaks users' NTLM password hashes
Microsoft's Nov 10 updates fix CVE-2026-124194, an Outlook spoofing flaw it says attackers have exploited. CISA added it to its KEV catalog the same day with a Nov 24 due date. Microsoft rates it moderate (CVSS 6.5). Who exploited it, and how widely, has not been said.
- CISA Known Exploited Vulnerabilities catalog (JSON feed, version 2026.11.10) (opens in a new tab)
- NVD: CVE-2026-124194 (opens in a new tab)
- SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (opens in a new tab)
- CSO Online: November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day (opens in a new tab)

















