CVE-2026-124194

Name of the Vulnerable Software and Affected Versions Microsoft 365 Apps for Enterprise (32- and 64-bit) Office LTSC 2021 Office LTSC 2024

Description Microsoft Office Outlook fails to warn users when performing potentially unsafe actions, allowing an unauthorized attacker to perform spoofing over a network. An attacker can exploit this by sending a specially crafted message file and persuading a user to open it. Upon opening, Outlook connects to a network location controlled by the attacker without displaying the standard external-content warning. This connection can leak authentication information, specifically NTLMv2 authentication hashes, which an attacker can use to impersonate the user. This issue has been actively exploited in real-world incidents.

Recommendations Apply the Microsoft November security updates for Microsoft 365 Apps for Enterprise. Apply the Microsoft November security updates for Office LTSC 2021. Apply the Microsoft November security updates for Office LTSC 2024.