Outlook Zero-Day Exploited to Steal NTLM Credentials via Crafted Messages
Written by AI from the linked story. Not reviewed by an editor. How this works
A zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) is being actively exploited in the wild, allowing attackers to steal NTLMv2 authentication hashes simply by tricking a user into opening a specially crafted message file. The stolen hash can be used in pass-the-hash or relay attacks, potentially granting attackers unauthorized access to internal systems without ever cracking a password. This vulnerability is particularly dangerous because it requires minimal user interaction and leverages a trusted application users open daily. Microsoft has released patches, but organizations that delay deployment remain exposed, especially since CISA has confirmed real-world exploitation. This incident underscores the compounding risk of unpatched software combined with users who cannot recognize suspicious message files.
Tactical Insight
Immediate actions
- Apply Microsoft's security update for the affected Outlook versions immediately, prioritizing internet-facing and high-privilege user workstations.
- Block outbound NTLM authentication requests to external or untrusted hosts at the firewall and proxy level to limit hash exposure.
- Add CVE-2026-124194 to your internal vulnerability tracking system and verify remediation across all endpoints before CISA's deadline.
Long-term improvements
- Disable or restrict NTLMv2 where possible and enforce Kerberos or modern authentication protocols across the environment.
- Maintain a fully up-to-date software asset inventory so patch coverage can be verified quickly when new critical CVEs are disclosed.
- Establish an emergency patching SLA (e.g., 48–72 hours) for CISA KEV-listed vulnerabilities to reduce the window of exploitation.
Detection measures
- Monitor outbound SMB/HTTP traffic from mail client processes for unexpected connections to external IP addresses or domains.
- Alert on NTLMv2 authentication events originating from workstations to unfamiliar or external destinations via SIEM rules.
- Conduct regular phishing simulation exercises that include suspicious attachment scenarios so users learn to report rather than open unknown message files.