Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

What happened

The company’s advisory provides no information about the observed attacks. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.”

The vulnerability was not publicly disclosed before the fix became available. Vulnerabilities CVE-2026-124194 (the public catalogue number for a specific software flaw) is the Outlook zero-day (a flaw already being used in attacks before a fix exists) for which Microsoft says it’s aware of active exploitation. Microsoft is a software and software development company based in Redmond. The zero-day, tracked as CVE-2026-124194 , has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place. Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5. For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft. The flaw cannot be triggered through the Preview Pane, Microsoft said. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery.