🔍 Read the full analysis: CISA’s Outlook Zero-Day Deadline Is November 24: Are You Ready? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog on Nov. 10. U.S. federal civilian agencies have until Nov. 24 to apply the available Office updates; CISA urges other organizations to prioritize remediation, but the deadline is not binding on them. The attackers, targets and start date of exploitation have not been disclosed.
CISA has set Nov. 24, 2026, as the deadline for U.S. federal civilian agencies to address CVE-2026-124194, a Microsoft Outlook vulnerability that the agency says is being actively exploited. Microsoft has released Office updates that fix the flaw, which can expose a user’s NTLMv2 hash if the user opens a malicious file. CISA’s deadline applies to federal civilian agencies; it encourages other organizations to prioritize the vulnerability but does not impose the same requirement on them.
CISA added the Outlook vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 10, alongside five flaws affecting products from Cisco, Barracuda Networks, Openwave and Google Chromium. The agency said the additions were based on evidence of active exploitation. The catalog directs federal civilian executive branch agencies to apply mitigations by Nov. 24, in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable.
Microsoft describes an attack in which an unauthenticated attacker sends a specially crafted Office file and persuades a user to open it in an affected version of Outlook. Outlook may then connect to an attacker-controlled network location without displaying its usual external-content warning. Microsoft says this can disclose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user. The attack requires a person to open the file; Microsoft says the Preview Pane is not an attack vector.
Microsoft lists no workaround for the vulnerability; installing the applicable security update is the fix. The source material identifies Office LTSC 2021 build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140 as fixed builds. Microsoft 365 Apps also received fixes in the Nov. 10 security release, with builds differing by update channel. Administrators should verify installed versions against Microsoft’s current release information rather than assume that an update policy has already installed the patch.
CISA’s Outlook Zero-Day Deadline Is November 24
CISA says CVE-2026-124194 is actively exploited. Federal civilian agencies must apply the available Office updates by November 24; other organizations are urged to prioritize remediation.
How the attack works
The described attack requires a user to open a malicious file in an affected version of Outlook.
An attacker persuades a user to open a malicious Office file.
It may connect to an attacker-controlled location without the usual external-content warning.
The user’s NTLMv2 hash may be disclosed and could be used to authenticate as that user.
Who must act by November 24?
CISA’s directive applies to federal civilian executive branch agencies; other organizations are encouraged to prioritize the flaw.
- Apply the mitigation by the deadline.
- Follow Microsoft’s update instructions or discontinue use if mitigation is unavailable.
- The federal deadline is not binding.
- Prioritize the update through risk-based vulnerability management.
Patch and verify
Microsoft says installing the applicable security update fixes the vulnerability; no workaround is listed.
Check the installed build
The source lists fixed build 16.0.14334.21048.
Compare versions
The source lists fixed build 16.0.17932.21140.
Check your update channel
Fixed builds vary by channel. Verify the installed version against Microsoft’s current release information.
What remains unknown
The available information confirms active exploitation but does not describe its scope.
- Who is behind the attacks or who was targeted.
- How many may have been affected or when exploitation began.
- Whether ransomware was involved; CISA’s listing records this as unknown.
Why the Outlook Patch Is Urgent
The risk is not that this flaw automatically runs code whenever Outlook receives a message. The described attack depends on a user opening a malicious file. Its significance is that opening the file can trigger a network connection that exposes authentication material without the expected warning. Microsoft says an attacker could use the disclosed hash to authenticate as the affected user.
That possibility matters particularly to organizations where a compromised account could provide access to additional internal resources. The source material characterizes the issue as a potential foothold, not proof that attackers have gained wider access. Microsoft rates the vulnerability Moderate and gives it a CVSS score of 6.5 out of 10; those ratings do not negate the immediate need to apply the available fix, given CISA’s active-exploitation listing.
For organizations outside the federal civilian branch, Nov. 24 is not a CISA-mandated deadline. But the catalog addition is a clear risk signal: CISA says organizations should prioritize KEV vulnerabilities through risk-based vulnerability management. Teams responsible for Office should check affected installations and confirm that the relevant update has actually been applied.
Popular right now
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Roborock Qrevo S Pro Robot Vacuum and Mop, 18,500 Pa Suction
As an affiliate, we earn on qualifying purchases.
How the KEV Deadline Applies
CISA’s KEV catalog identifies vulnerabilities for which it has evidence of exploitation and helps drive remediation priorities. In this case, CISA’s Nov. 10 notice names the Outlook issue as one of six newly added vulnerabilities. Its directive, BOD 26-04, applies to federal civilian executive branch agencies, with the catalog entry setting Nov. 24 as the due date.
CISA’s notice says the requirement is limited to those agencies, while encouraging all organizations to prioritize KEV entries. The action listed for the Outlook flaw is to apply mitigations following vendor instructions; the source material says Microsoft’s update is available. It also reports that the catalog entry marks ransomware use as unknown and does not require forensic triage. Those fields do not establish that no intrusion occurred; they describe what the listing records and requires.
Microsoft’s description classifies the issue as an Outlook spoofing vulnerability and attributes it to a failure to warn users about an unsafe action. The vulnerability is listed for Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Microsoft’s fixed-build details vary for Microsoft 365 Apps by channel, so organizations should consult the release entry for their deployment.
““based on evidence of active exploitation””
— CISA, in its Nov. 10 KEV notice
What Is Not Yet Known
The available source material does not identify who is behind the attacks, which people or organizations were targeted, how many may have been affected, or when exploitation began. CISA’s active-exploitation designation confirms that the vulnerability is being used, but the information provided does not describe the incidents or establish their scope.
The catalog records ransomware use as unknown. That does not confirm a link to ransomware, nor does it rule one out. The listing also does not call for forensic triage under the directive; this should not be read as evidence that attackers did not access systems. The source material provides no independent incident counts or details about any resulting account compromise.
Patch Checks Before Nov. 24
Federal civilian agency teams should meet the Nov. 24 deadline by applying the appropriate Microsoft update and confirming the installed Office build on affected devices. Organizations using Microsoft 365 Apps need to check the build for their specific channel, while Office LTSC administrators can compare installations with Microsoft’s listed fixed builds. The supplied source material does not include every Microsoft 365 channel build, so administrators should verify the complete, current version list in Microsoft’s security release information.
Other organizations can use the same update guidance to prioritize remediation even though the federal directive does not bind them. CISA’s catalog listing and Microsoft’s advisories remain the relevant sources for changes to the vulnerability information. Further details about the attackers, targets and duration of exploitation have not been provided in the source material.
Key Questions
What is the Nov. 24 deadline for?
It is the date by which U.S. federal civilian executive branch agencies must address CVE-2026-124194 under CISA’s KEV directive. CISA encourages other organizations to prioritize the flaw but does not apply that federal deadline to them.
How does the Outlook vulnerability work?
Microsoft says an attacker can send a specially crafted file and try to persuade a user to open it in an affected version of Outlook. Outlook may then connect to an attacker-controlled location without its usual warning, exposing the user’s NTLMv2 hash.
Does the attack work through Outlook’s Preview Pane?
Microsoft says the Preview Pane is not an attack vector. Its described attack requires the user to open the malicious file.
Is there a workaround?
The source material says Microsoft lists no workaround; the security update is the fix. Administrators should confirm the installed build for each Office product and Microsoft 365 Apps channel.
Who has been targeted?
The available information does not identify the attackers, targets, number of affected users or start date of exploitation. CISA’s listing confirms active exploitation but does not provide those details.
Source: ThorstenMeyerAI.com
