unpatched/intel
Latest briefing
Patch nowExploitedKEVhighThreat Roundup

Microsoft Outlook flaw CVE-2026-124194 exploited to leak NTLM v2 hashes

By Harith Dilshan2 min read

TL;DR

Microsoft released 1,092 vulnerabilities this November, including an actively exploited Outlook spoofing flaw, CVE-2026-124194. Attackers are using this to leak NTLM v2 hashes. Update all supported versions of classic Outlook immediately to prevent credential theft.

What happened

Microsoft's November 2026 Patch Tuesday includes 1,102 vulnerabilities affecting Windows. The most urgent is CVE-2026-124194, a spoofing vulnerability in classic Outlook that is currently being exploited in the wild. When a user opens a specially crafted malicious file, Outlook silently connects to an attacker-controlled location to leak the user's NTLM v2 hash.

Two other critical pre-authentication remote code execution (RCE) vulnerabilities were disclosed. CVE-2026-119952 targets the Windows Schannel component (the implementation of TLS), while CVE-2026-116928 targets the Windows Search component. The latter can be triggered via malicious email attachments processed by Exchange.

Why it matters

The Outlook vulnerability is a high-value target for both commodity attackers and sophisticated actors. While the CVSS score is 6.5, the stolen NTLM v2 hashes can be cracked offline or relayed live to impersonate users against services lacking SMB/LDAP message signing or Extended Protection for Authentication.

The two RCE vulnerabilities represent significant risks. The Schannel flaw allows code execution via malicious packets, often without needing a foothold on the local subnet. The Windows Search flaw allows an attacker to gain control of an Exchange server simply by sending a malicious attachment.

Who is affected

  • Classic Outlook (all supported versions)
    • Windows Schannel (all versions)
    • Exchange Subscription Edition (running on Windows)
    • .NET 8
    • PowerShell 7.4 LTS
    • Windows 11 23H2 (Enterprise, Education, and IoT editions)

What to do now

  1. Update all supported versions of classic Outlook to patch CVE-2026-124194.
  2. Apply Windows updates to mitigate Schannel RCE (CVE-2026-119952) and Windows Search RCE (CVE-2026-116928).
  3. Implement SMB message signing or LDAP signing to prevent NTLM v2 hash relay attacks.
  4. Enable Extended Protection for Authentication for Exchange or Active Directory Certificate Services.

What we don't know yet

  • The exact number of victims for the exploited Outlook vulnerability.
  • The specific execution context and privilege level for the Schannel RCE (CVE-2026-119952).
  • The specific execution context and privilege level for the Windows Search RCE (CVE-2026-116928).

Sources

  1. rapid7.comhttps://www.rapid7.com/blog/post/em-patch-tuesday-november-2026
  2. msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
  3. msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-119952
  4. learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/security/tls/tls-ssl-schannel-ssp-overview

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

Patch nowExploitedhighThreat RoundupNew

Synology DSM flaws exploited in ransomware attacks and Trezor hardware implants detected

Synology DSM users are being targeted by ransomware exploiting unpatched vulnerabilities, and Trezor warns of hardware implants in specific devices. Secure your systems by upgrading Synology DSM immediately and moving funds if you purchased a Trezor Safe 5 from CryptoBilis.

CVE-2024-583512 min
Patch nowExploitedhighExploited VulnerabilitiesNew

Lazarus Group exploits Windows kernel vulnerability to escalate privileges via fake job offers

Lazarus Group is exploiting a Windows kernel vulnerability to escalate privileges and deploy backdoors via fake job offers. The campaign targets the defense, aerospace, and aviation sectors across Europe, India, Brazil, and Germany. Prioritize applying the August Patch Tuesday updates to remediate the afd.sys flaw.

4 min
Patch nowExploitedhighExploited VulnerabilitiesNew

Critical Windows kernel flaw exploitation drives massive Microsoft security patch release

Microsoft has released a massive update addressing 398 security flaws, including one critical vulnerability currently being exploited in the wild. The most urgent fix targets afd.sys, a core Windows component used for socket connections. Prioritize testing and deploying patches for privilege escalation vulnerabilities while maintaining backups before large-scale rollouts.

2 min