Microsoft Closed 1,200+ Vulnerabilities: Outlook Zero-Day Steals NTLMv2 Hashes

Microsoft released the November Patch Tuesday — its monthly security-update package, this time closing a record 1,200+ vulnerabilities in Windows, Office, SharePoint, and other products. The headline is an actively exploited zero-day in Microsoft Outlook that lets an attacker steal a user account's NTLMv2 hash and then impersonate them on the corporate network.

The vulnerability received the identifier CVE-2026-124194 and a CVSS 6.5 ("moderate") rating. Microsoft officially confirmed the bug is already being exploited in real attacks — meaning the patch closes a hole attackers were using before a fix existed. Despite the "moderate" status, experts call it one of the month's most dangerous: email is the simplest "door" into any company, and Outlook sits in almost every organization.

This attack type — stealing NTLM hashes via malicious attachments — isn't new. Similar vulnerabilities have been exploited in phishing campaigns for years, and Microsoft has repeatedly closed analogous holes. Tellingly, Ukrainian institutions have been among the victims: years ago Microsoft reported a Windows zero-day used specifically against organizations in Ukraine. That's exactly why another such bug is a reason not to ignore, but to update immediately.

In this article we break down how the attack works, why a stolen NTLMv2 hash is serious, what else Microsoft closed, and how to protect your own systems.

Outlook zero-day: how the NTLMv2 hash is stolen

Technically CVE-2026-124194 is a spoofing vulnerability tied to the fact that the Outlook UI doesn't warn users about a potentially unsafe action. Per Microsoft's wording: "Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network."

The attack scenario is simple and requires no prior rights on the victim's network:

1. The attacker crafts a specially formed message file (.msg) and sends it to the victim — via email or another channel.
2. The user opens the file in Outlook.
3. Instead of the usual external-content warning, Outlook silently contacts a network resource the attacker controls (usually an SMB server).
4. Windows automatically tries to authenticate to that server, sending the user account's NTLMv2 hash.
5. The attacker intercepts the hash and uses it for impersonation — authenticating as the victim.

An important detail: the attack doesn't fire through the Preview Pane. The victim must open the file themselves, and success requires network reachability and user interaction. This makes it resemble classic phishing, but with a key difference — the user sees no warning and doesn't realize anything dangerous is happening.

The vulnerability was found and reported by researcher "Nono" and Benoît Sevens of Anthropic, who used the Claude model. Another reminder that LLMs are becoming a full-fledged tool in vulnerability research too.

Why an NTLMv2 hash is valuable loot

NTLMv2 is a Windows authentication mechanism still widely used in corporate networks. A stolen hash isn't itself a plaintext password, but it opens two powerful attack directions:

• Offline cracking. The hash can be attacked offline with dictionaries or brute force. If the password is weak, it's recovered in minutes or hours.
• Relay attacks. The hash can be relayed, without cracking, to another service accepting NTLM authentication. That's how the attacker logs in as the victim without knowing the password.

Why does Outlook "hand over" the hash at all? The mail client can render external content and contact network resources a message points to. Normally Outlook shows an external-content warning before doing so. A specially formed file bypasses that warning, so the user sees no danger signal — while Windows has already sent its hash to the attacker's server.

This is a close relative of the well-known pass-the-hash technique: instead of the password, the attacker operates on the hash itself. The difference is that relay works "on the fly," redirecting authentication between machines, while pass-the-hash uses an already-stolen hash to log in directly. Both share one consequence — the attacker acts under the victim's legitimate account, and logging systems see ordinary authentication.

As Jack Bicer, director of vulnerability research at Action1, explained: "Email is the easiest door into any company, and this vulnerability turns one opened file into a stolen identity. A stolen hash lets the attacker log in as the victim, read their data, and move further to other systems they can access."

That's why experts advise taking CVE-2026-124194 seriously despite the "moderate" CVSS: what matters isn't the score but that the vulnerability is already in attackers' hands and hits the most common mail client in business.

What else was closed this month

Besides the zero-day, the November package contains dozens of critical fixes. Per CrowdStrike, among 1,252 CVEs there are 68 critical; BleepingComputer counted 66 critical, 48 of them remote code execution (RCE).

The most alarming categories:

• Eight critical RCEs in Office apps (Outlook and Word). Among them CVE-2026-110043 and CVE-2026-110068 in Outlook: merely selecting a malicious message in the reading pane or previewing an attachment in File Explorer triggers code execution — no click or macros. This is the same "preview-pane exploitation" pattern attackers have used for three straight months.
• Critical RCE in the LDAP protocol (CVE-2026-119958) and in Active Directory Domain Services (CVE-2026-118146, CVE-2026-118148). These underpin domain authentication, so compromising them can grow into whole-domain compromise.
• Eight elevation-of-privilege flaws in Windows Hyper-V. Hyper-V underlies Azure and features like Windows Sandbox and Credential Guard, so the blast radius is wider than it first appears.

By exploitation technique, nearly half of this month's patches are elevation-of-privilege — 533 fixes (43%), followed by RCE — 296 (24%), and information disclosure — 156 (12%). By product, the most updates went to Windows (745), Extended Security Updates (658), and Microsoft Office (201).

This distribution illustrates where attacker focus has shifted: identity (LDAP, AD DS) and email (Office/Outlook) are the two most valuable assets for initial access and lateral movement. Separately, Microsoft continues using AI to find and fix vulnerabilities — partly explaining the sharp rise in monthly patch volume.

Record volumes: why the numbers are so big

The November Patch Tuesday is the second straight month Microsoft closed 1,000+ vulnerabilities. In October there was a record 1,411 fixes per BleepingComputer. Such numbers are easy to read as "Microsoft is getting less secure," but they more likely signal the opposite: the company systematically and automatically hunts vulnerabilities, including with AI, and closes them faster than before.

It's worth understanding the counting differences. Some outlets count only CVEs released on Patch Tuesday itself (hence ~1,093–1,094), while others add all fixes for the month, including Edge, Mariner, and other components released earlier. Hence the discrepancy — 1,235, 1,252, or 1,259 depending on methodology.

For practical defense, the exact numbers matter less than prioritization: among hundreds of fixes, the critical ones to install first are the Outlook updates (zero-day) and identity components (LDAP / AD DS).

How to protect yourself: a practical checklist

1. Install the November updates immediately, especially on mail servers and Outlook workstations. Priority: CVE-2026-124194, plus critical RCEs in Office, LDAP, and AD DS.
2. Block outbound SMB (TCP 445) on the firewall. It's precisely through outbound SMB that Windows "hands over" NTLM hashes to an external attacker server. Blocking port 445 to the internet nullifies this vector entirely.
3. Restrict NTLM in favor of Kerberos. Configure the "Network security: Restrict NTLM" group policy and raise LmCompatibilityLevel. Where possible, fully disable NTLM.
4. Enable Extended Protection for Authentication (EPA) on critical services — it substantially complicates relay attacks.
5. Enable MFA everywhere possible. Even a stolen hash or password becomes far less useful if a second factor is required.
6. Monitor anomalous NTLM activity: unusual outbound connections and events 4624 and 4776 in logs. An NTLM-authentication spike is often the first sign of an attack.
7. Train users not to open unexpected attachments, especially .msg files from unknown senders, even if they look legitimate.

If you can't install patches immediately, apply temporary compensating measures: blocking outbound SMB (point 2) and restricting NTLM (point 3) work regardless of Outlook version and can block the attack even without the patch. This is a case where network defense bridges the gap between an update's release and its actual rollout across the organization.

Separately, note legacy systems: NTLM often stays enabled precisely for compatibility with old apps or devices. If you can't fully disable it yet, audit where exactly it's used and gradually replace those dependencies with Kerberos or other modern authentication mechanisms.

And as always: check whether your credentials already appeared in prior leaks using our Breach Check — if passwords are compromised, change them regardless of this vulnerability. For a deeper look at how such attacks work and how to build defense at the organization level, see our cybersecurity learning material.

Conclusion

The November Patch Tuesday is another signal that email-based attacks remain the cheapest and largest vector for entering corporate networks. The Outlook zero-day requires nothing from the attacker but the ability to send a file and wait for one victim click — yet the cost of a mistake is a stolen user identity in the domain.

The "moderate" CVSS is misleading here: the vulnerability is already exploited, it hits the most common mail client in business, and a stolen hash can open doors far beyond the mailbox. So this week's top task for IT teams is to install patches and restrict the NTLM/SMB attack at the network level — without waiting for the attack to touch your organization.