What happened

Microsoft's November 2026 Patch Tuesday fixed more than 1,000 vulnerabilities. According to Microsoft, as reported by SecurityWeek and Krebs on Security, only one of them is known to be exploited: CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook.

Microsoft rates the bug moderate with a CVSS score of 6.5. Its advisory describes the problem as Outlook not alerting the user before a potentially dangerous action. An unauthenticated attacker sends a specially crafted message file and convinces the user to open it. Opening the file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. Microsoft states that this discloses the user's NTLMv2 hash, which the attacker can use to authenticate as that user.

According to Microsoft, the Preview Pane is not an attack vector, so the user has to open the file. The affected products listed are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The flaw was not publicly disclosed before the fix, and Microsoft's advisory gives no details about the observed attacks.

Why it matters

A moderate score can hide a serious outcome. A leaked NTLMv2 hash is not a plaintext password, but it can be cracked offline when the password is weak, and in some environments it can be relayed to other services that accept NTLM authentication. Either path can turn one click on an email attachment into a valid identity inside your network or cloud tenant.

The requirement for user interaction lowers the urgency on paper, but message files delivered by email are exactly what phishing campaigns send. Because the usual external-content warning is suppressed, the user gets no visual hint that anything unusual happened.

What defenders should check

  • Patch status. Confirm the November 2026 Office updates are installed on Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Check actual build numbers from inventory, not just deployment policy status.
  • Egress filtering. Verify that user subnets cannot reach the internet over TCP 445 and 139, and review whether WebDAV over HTTP is allowed to arbitrary hosts.
  • NTLM posture. Review where NTLM is still needed. Restricting outgoing NTLM to external or non-corporate destinations reduces what a leaked hash can reach. Where possible, require SMB signing and enable Extended Protection for Authentication on internal services.
  • Mail controls. Check whether your mail gateway lets message-file attachments through from external senders, and whether users have a simple way to report them.

Detection ideas

These are starting points to adapt and test in your environment, not production-ready rules.

Microsoft Defender for Endpoint, Outlook initiating outbound SMB to public addresses:

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort

Firewall or proxy logs, workstation subnets reaching SMB on the internet (generic example, adjust field names):

CommonSecurityLog
| where DestinationPort in (445, 139)
| where ipv4_is_private(DestinationIP) == false
| where SourceIP startswith "10."

Windows Security log, NTLM network logons on servers from workstation addresses shortly after the above activity:

SecurityEvent
| where EventID == 4624 and LogonType == 3
| where AuthenticationPackageName == "NTLM"
| project TimeGenerated, Computer, TargetUserName, IpAddress, WorkstationName

Also look for Outlook opening message files delivered from external senders shortly before an outbound connection from the same host.

Investigation

If you suspect a user opened a malicious file, collect:

  • The original email and attachment, with headers, preserved in a safe store
  • Outlook and endpoint network telemetry around the open time, especially connections to unfamiliar public IPs on 445, 139 or 80/443 with WebDAV user agents
  • Authentication logs (4624, 4625, 4648, and identity provider sign-ins) for that account from new source addresses, in the hours and days after
  • Firewall logs showing which external host received the connection, and whether it connected from other users too

Treat the account's credentials as exposed: reset the password, revoke sessions and review mailbox rules and sign-ins for the account. Search mail logs for the same sender, subject or attachment hash across other recipients.

Mitigation

Install the November 2026 security updates for Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Block outbound SMB at the perimeter. Reduce NTLM usage and enforce SMB signing. Use strong, long passwords or passkeys so that a captured hash is hard to crack, and keep a clear process for users to report suspicious attachments. If you need help hunting for credential exposure, our incident response and threat hunting teams can assist.