Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes
Microsoft confirms hackers exploit Outlook 0-day to steal Windows authentication hashes.
Microsoft has confirmed hackers are exploiting an Outlook zero-day vulnerability, tracked as CVE-2026-124194, that allows them to steal Windows authentication hashes. The vulnerability, patched on November 10, 2026, requires user interaction to open a malicious file, which then connects to an attacker-controlled network location without usual warnings. Successful exploitation discloses the user's NTLMv2 hash, potentially enabling authentication relay and offline password cracking.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA confirmed zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allowed attackers to steal Windows NTLMv2 authentication hashes simply by getting a user to open a malicious file, which then silently connected to an attacker-controlled server. Because NTLM hashes can be relayed in pass-the-hash attacks or cracked offline to recover plaintext passwords, this exposure can lead to full account compromise without the victim ever knowing. The vulnerability was patched on November 10, 2026, meaning any organization that did not apply the patch promptly remained exposed to active exploitation. This incident illustrates how a single unpatched application can expose foundational Windows authentication credentials across an entire organization.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-124194