🔍 Read the full analysis: CISA Gives Outlook Teams Until November 24 To Patch The Zero-Day on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CISA added CVE-2026-124194, an actively exploited Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog on Nov. 10, 2026. Federal civilian agencies must apply the available Office updates by Nov. 24; CISA urges other organizations to prioritize the flaw, but the deadline is not binding on them.
The U.S. Cybersecurity and Infrastructure Security Agency has given federal civilian agencies until Nov. 24 to address CVE-2026-124194, a Microsoft Outlook vulnerability that Microsoft and CISA say is being actively exploited. Microsoft has released Office updates that fix the flaw; CISA encourages other organizations to prioritize it, but its deadline applies only to federal civilian executive branch agencies.
CISA added the Outlook vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 10, citing evidence of active exploitation. The catalog entry directs covered agencies to apply vendor mitigations by Nov. 24, 2026, or discontinue use of the affected product if mitigations are unavailable. Microsoft has shipped updates, and its security entry lists no workaround.
Microsoft describes an attack in which an unauthenticated attacker sends a specially crafted file and persuades a user to open it in an affected version of Outlook. Outlook can then connect to a network location controlled by the attacker without displaying its usual external-content warning. Microsoft says that connection can expose the user’s NTLMv2 hash, which an attacker could use to authenticate as that user.
The affected products named in the source material include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. Microsoft lists fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Microsoft 365 Apps fixes are provided through November security updates for the relevant update channels; administrators should check Microsoft’s release information for the build corresponding to their channel.
Outlook zero-day demands action for covered agencies
CISA confirmed active exploitation of an Outlook vulnerability and set a patch deadline for federal civilian agencies. Microsoft has released Office updates.
Who must act by the deadline?
The directive applies to federal civilian executive branch agencies; other organizations are urged to prioritize remediation.
- Apply vendor mitigations by Nov. 24, 2026.
- If mitigations are unavailable, discontinue use of the affected product.
- The federal deadline is not binding on them.
- CISA recommends risk-based prioritization of KEV vulnerabilities.
How the attack works
Microsoft says the described attack requires a user to open a specially crafted file.
An attacker persuades a user to open a specially crafted file in affected Outlook.
Outlook may connect without its usual external-content warning.
The connection could expose the user’s NTLMv2 hash, which may be used to authenticate as that user.
Update affected Office builds
Microsoft lists security updates as the fix and no workaround.
| Product | Fixed version or guidance |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps | November security update; build depends on update channel |
What remains unknown
The available source material does not identify the attackers, targets, number of affected systems, or when exploitation began.
Why Outlook Teams Face a Deadline
The issue combines confirmed exploitation with a credential-theft risk. A stolen NTLMv2 hash may give an attacker a way to authenticate as the affected user, potentially putting other systems or company information at risk. Microsoft says the attack requires a person to open a malicious file, so the described method depends on convincing a user rather than silently compromising Outlook simply by displaying a message.
The CISA date has a specific regulatory reach: its directive applies to U.S. federal civilian executive branch agencies, not every business or government body. For other organizations, CISA’s KEV addition is a risk signal and a recommendation to prioritize remediation, not a federal compliance deadline. Because Microsoft lists no workaround, teams using affected builds need to apply the relevant update to address the documented vulnerability.
Products Worth Considering
Dell 27 Plus 4K Monitor (S2725QS), 27-inch IPS, 120Hz
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Blush
LG 27US500-W 27-Inch 4K UHD IPS Monitor
As an affiliate, we earn on qualifying purchases.
How CISA and Microsoft Describe It
Microsoft identifies the issue as the Microsoft Outlook Spoofing Vulnerability and rates it moderate, with a CVSS score of 6.5 out of 10. Its description says the attacker must send a malicious Office file and convince a user to open it. Microsoft also says the Preview Pane is not an attack vector, meaning simply previewing the file is not the attack path described in its guidance.
CISA’s Nov. 10 catalog update included six vulnerabilities across products from Microsoft, Cisco, Barracuda Networks, Openwave and Google Chromium. For the Outlook entry, CISA’s required action is to apply mitigations according to the vendor’s instructions. CISA says its directive, BOD 26-04, applies only to federal civilian executive branch agencies, while encouraging all organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.
The source material also reports that CISA’s catalog lists ransomware use as unknown and does not mark the flaw for forensic triage. Those fields do not establish that ransomware is involved or that affected systems have not been compromised; they describe what is recorded in the catalog. The source author interprets the need for user interaction as more consistent with targeted messages than an automated, fast-spreading attack, but that is analysis rather than a CISA finding.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”
— Microsoft, as quoted in its security entry
What Is Not Yet Known
The available source material does not identify who is conducting the attacks, which organizations or individuals have been targeted, how many may be affected, or when exploitation began. CISA lists use in ransomware campaigns as unknown. The active-exploitation designation confirms that attacks have been observed, but does not by itself reveal their scale or whether a particular organization has been compromised.
The catalog’s lack of a forensic-triage flag should not be read as proof that no attacker has accessed affected systems. Nor does the reported user-interaction requirement establish how widely the vulnerability is being exploited. Further details about incidents, targets and attack methods were not provided in the source material.
Apply the Update and Check Builds
Covered agencies face the Nov. 24 deadline and should confirm that affected Office installations have reached Microsoft’s fixed builds. IT teams should check installed versions across Microsoft 365 Apps channels as well as Office LTSC deployments; the specific Microsoft 365 Apps build varies by channel and release. The source material identifies November 10 updates but does not provide a complete list of channel builds, so administrators should consult Microsoft’s current security release guidance.
Organizations outside the federal civilian executive branch have no deadline under this directive, but CISA recommends prioritizing the vulnerability. Microsoft lists an update—not a workaround—as the fix. CISA and Microsoft may provide further information about exploitation or affected environments, but the source material gives no announced follow-up milestone beyond the federal remediation date.
Key Questions
What is the Nov. 24 deadline for?
It is CISA’s deadline for U.S. federal civilian executive branch agencies to apply mitigations for CVE-2026-124194, or discontinue use of the product if mitigations are unavailable. Microsoft has released updates for affected Office products.
Does the deadline apply to private companies?
No. CISA says the directive applies only to federal civilian agencies. It encourages other organizations to prioritize vulnerabilities in its KEV catalog, but the Nov. 24 date is not a binding deadline for them under this directive.
How does the Outlook vulnerability work?
Microsoft says an attacker must persuade a user to open a specially crafted file in affected Outlook software. Outlook may then connect to an attacker-controlled network location without its usual warning, potentially exposing the user’s NTLMv2 hash.
Is there a workaround?
Microsoft’s entry lists no workaround. It identifies Office security updates as the fix. Administrators should check Microsoft’s guidance for the fixed build applicable to each product and Microsoft 365 Apps channel.
Who is behind the attacks, and how many systems are affected?
The source material does not identify the attackers, targets, number of affected users or organizations, or when exploitation began. CISA’s catalog lists ransomware use as unknown.
Source: ThorstenMeyerAI.com
