Product UI does not warn user of unsafe actions in Microsoft products - CVE-2026-124194
Published: November 10, 2026
Vulnerability identifier: #VU164604
CSH Severity: High
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-124194
CWE-ID: CWE-356
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to obtain a user's NTLMv2 authentication hash.
The vulnerability exists due to a failure to warn users of unsafe actions in Microsoft Office Outlook when opening a specially crafted message file. A remote attacker can convince a user to open the file, causing Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, to obtain the user's NTLMv2 authentication hash.
The Preview Pane is not an exploitation vector.
Note, the vulnerability is being exploited in the wild.
Affected software
Microsoft Office
Microsoft 365 Apps for Enterprise
Microsoft Office LTSC
Microsoft 365 Apps for Enterprise
Microsoft Office LTSC
How to mitigate CVE-2026-124194
Install security update from vendor's website.
Microsoft Office - addressed in versions 16.0.14334.21048, 16.0.17932.21140
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.20326.20318, 16.0.20326.20320, 16.0.20430.20262, 16.0.20430.20264, 16.0.20527.20192, 16.0.20527.20194, 16.0.20527.20196
Microsoft Office LTSC - addressed in versions 16.0.14334.21048, 16.0.17932.21140
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.20326.20318, 16.0.20326.20320, 16.0.20430.20262, 16.0.20430.20264, 16.0.20527.20192, 16.0.20527.20194, 16.0.20527.20196
Microsoft Office LTSC - addressed in versions 16.0.14334.21048, 16.0.17932.21140