Microsoft Fixes Zero-Day in Outlook Exposing NTLM Hashes

Microsoft released the November security patch on Tuesday (10) addressing a single vulnerability already exploited by attackers: CVE-2026-124194, a spoofing bug in Outlook that exposes the victim's NTLM hash to the attacker. Microsoft itself classifies the vulnerability as "Moderate"; however, researchers are urging security teams to disregard this rating.

According to Rapid7's analysis, simply opening a message file crafted by the attacker causes Outlook to silently connect to a server controlled by them and reveal the user's NTLMv2 hash. Dustin Childs of the Zero Day Initiative describes the same behavior and highlights an operational detail: the connection occurs without the external content warning that typically alerts the user. For Childs, downgrading the priority of the patch due to the low severity rating is a mistake.

Why a Hash is Worth More Than the Rating Suggests

An NTLMv2 hash is not a password, but it acts as a key in Windows environments still using the protocol. With it, an attacker can attempt to crack the password offline or relay authentication to other network services, a technique known as relay. Rapid7 argues that the official score underestimates the value of the vulnerability for both common criminals and targeted operations.

The pattern has a history. CVE-2023-23397, another Outlook flaw that leaked NTLM credentials, was exploited as a zero-day since at least April 2022, nearly a year before the patch was issued. The difference now is that the victim must open the file; in 2023, merely receiving the message was sufficient. The interaction requirement reduces the scope of a mass attack but is negligible in a targeted campaign against a few executive mailboxes.

The Volume Pressuring Patch Teams

The size of the patch itself has made headlines. Tenable counts 1,093 vulnerabilities fixed, 63 of which are classified as critical. BleepingComputer reports up to 1,235 flaws, a number attributed to a different counting methodology. Other assessments report 1,094. By any measure, this is a volume that no patch team can test item by item before applying.

Among the critical issues, three demand immediate attention from infrastructure administrators. CVE-2026-119952 allows remote code execution in Schannel, Windows’ component implementing TLS, and received a CVSS score of 8.1 according to Cisco Talos, with high attack complexity. In Microsoft's update guide, the vulnerability appears with a maximum Critical severity label, which Tenable also uses in its priority list. The Zero Day Initiative classifies two others as zero-click: CVE-2026-116928, in Windows Search, and CVE-2026-119958, in Windows LDAP. Zero-click vulnerabilities require no user action, making them prime candidates for mass exploitation once a public proof of concept surfaces.

As of this writing, the analyses consulted did not indicate active exploitation of the critical vulnerabilities, only of CVE-2026-124194 in Outlook.

Where Risk Falls in Operations

The priority order echoed in the analyses of Rapid7, Tenable, and Splashtop is consistent: Outlook first, followed by domain controllers and authentication servers. Splashtop recommends applying patches for Active Directory and Schannel within 72 hours on servers authenticating users.

The weight of this timeline doesn’t distribute evenly. In the United States and Europe, many large companies outsource their patch window to managed service providers, many of which have delivery centers in India and operate with contractually defined update windows. A zero-day labeled as "Moderate" risks falling into the general queue of these workflows unless the client manually reclassifies the vulnerability. In Brazil, where banks and insurance companies operate under the cyber security rules of the Central Bank and Susep, the requirement to prioritize exploited vulnerabilities gives the CISO a formal basis to expedite the patch, but the same dependency on external vendors arises.

The common point among these markets is contractual rather than technical. Managed service contracts linking the correction deadline to the severity declared by the manufacturer leave a gap every time Microsoft assigns a low rating to an already exploited vulnerability. The November patch is a good test to discover if the agreements made by the company trigger on active exploitation or merely on the manufacturer's label.