CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability

A zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) is being actively exploited in the wild, allowing attackers to steal NTLMv2 authentication hashes simply by tricking a user into opening a specially crafted message file. The stolen hash can be used in pass-the-hash or relay attacks, potentially granting attackers unauthorized access to internal systems without ever cracking a password. This vulnerability is particularly dangerous because it requires minimal user interaction and leverages a trusted application users open daily. Microsoft has released patches, but organizations that delay deployment remain exposed, especially since CISA has confirmed real-world exploitation. This incident underscores the compounding risk of unpatched software combined with users who cannot recognize suspicious message files.