Most email attacks need you to type a password into a fake page. This one only needs you to open a file. A flaw Microsoft fixed on 10 November makes Outlook quietly hand your Windows sign-in to a server the attacker controls, and Microsoft says attackers were already using it before the fix existed.
What happened
When an email or document refers to a picture or file stored somewhere else on the internet, Outlook is supposed to hold back and warn you before reaching out to fetch it. That warning exists for a reason: when Windows connects to a file server, it can automatically prove who you are by sending a scrambled form of your password, called an NTLM hash.
Microsoft says an attacker can craft a message file that skips that warning. The victim receives it, usually as an attachment, and opens it. Outlook then connects to a network location the attacker chose, and Windows sends the user's NTLMv2 hash along with the connection. The victim sees nothing unusual.
The Preview Pane is not enough to trigger it, according to Microsoft. The user has to open the file. That is why Microsoft rates the flaw only "Moderate", and it is also why the attackers' job is mostly persuasion: an attachment that looks like an invoice, a voicemail or a shared document.
Microsoft fixed it as part of a November release that addressed more than 1,000 vulnerabilities, one of the largest monthly releases it has ever published. This was the only one Microsoft marked as already exploited.
Why it matters
A stolen NTLM hash is not the password itself, but it is close enough to be dangerous in two ways. The attacker can try to recover the password from it offline, guessing at enormous speed, and short or common passwords fall quickly. Or, on networks that still accept NTLM, the attacker can relay the sign-in to another server in real time and act as the user there, without ever learning the password.
Either way, the result is the same as a successful phishing page: someone else signs in as your employee. The difference is that the employee never typed anything, so they have no reason to report it.
The "Moderate" label undersells this. Microsoft's rating describes a single bug in isolation. The fact that matters for a business is that attackers found it before Microsoft did and have been using it. A very similar Outlook flaw in 2023, CVE-2023-23397, was used by Russian military hackers against government and energy organizations in Europe for close to a year before it was discovered.
Does two-factor authentication still protect you?
Partly, and it depends on where the stolen sign-in is used.
Microsoft 365 and other cloud services: mostly yes. If the attacker cracks the hash and recovers the password, and that password also signs in to Microsoft 365, they still need the second factor. With two-factor authentication required on every sign-in, the password alone gets them nowhere. The protection is only as strong as the weakest way in, though. It does not help on any route that still accepts just a password, such as a VPN, remote desktop or an old email app connecting without two-factor. It is weaker if the second factor is a code by text message or a push prompt people approve without thinking. An authenticator app with number matching, or a passkey or security key, is much harder to get past.
Your own network: often no. Inside an office network, Windows signs people in to file shares, printers, servers and many internal applications with NTLM itself, and those sign-ins never ask for a second factor. An attacker who can relay the stolen sign-in to one of those systems, or who cracks the password and reaches a system that only asks for a password, gets in as the user without any two-factor prompt. This is why the stolen hash is dangerous even in businesses that have two-factor turned on for email.
Changing the password ends it. The hash is derived from the password. Once the user sets a new password, the captured hash, and anything cracked from it, stops working.
How to tell if it was used against you
There is no single test, and Microsoft has not published signs to look for in this case. These are the places to check, or to ask your IT provider to check.
Look for the leak itself. The attack only works if the computer connects out to the attacker's server. Firewall logs showing workstations connecting to unfamiliar internet addresses on port 445 (SMB, Windows file sharing) are a strong sign that a hash was sent. If outbound port 445 was already blocked, that route was closed.
Look for the file. Search mailboxes for attached message files and Office documents from senders nobody recognises, especially ones someone opened. Microsoft says the flaw was exploited before 10 November, so look back several weeks.
Look for the stolen sign-in being used. In Microsoft 365, review the sign-in logs for each user for logins from unexpected countries or devices, attempts that passed the password but failed two-factor, and new two-factor methods or inbox forwarding rules the user did not set up. On a Windows domain, the domain controllers record NTLM sign-ins; a user's account signing in from a machine or at a time that makes no sense is the warning sign.
If anything looks wrong, reset first and investigate second. Change the user's password, sign them out of all sessions in Microsoft 365, and remove any two-factor methods or mail rules they did not create. Then work out what the account touched.
What to actually do
Install the November Office update on every Windows computer. For Office LTSC 2024 the fixed version is build 16.0.17932.21140, and for Office LTSC 2021 it is 16.0.14334.21048. Microsoft 365 Apps update themselves, but only on their schedule, so open any Office app, go to File → Account → Update Options → Update Now, and confirm the version afterwards. Office 2016 and 2019 stopped receiving security fixes in October 2025 and should be replaced.
Block outgoing file-sharing traffic at your firewall. Windows sends these sign-ins over the SMB protocol, on TCP port 445. Almost no business needs to reach file servers on the open internet, so blocking port 445 outbound stops this flaw and the next one like it from sending your hashes out.
Make the stolen hash worth less. Long, unique passwords make a captured hash far harder to crack. On a Windows domain, add administrators and other sensitive accounts to the Protected Users group, which stops them from using NTLM at all, and ask your IT provider whether NTLM can be restricted on your network.
Tell your staff about attachments they did not expect. The attack depends on someone opening a file. A quick message to the team, saying to check with the sender before opening unexpected email attachments, including attached emails and Office files, raises the bar for the attacker.
The summary
This is a quiet attack: open an attachment, and your Windows sign-in leaves the building without any warning. Microsoft has fixed it, attackers are already using it, and the fix is an ordinary Office update. Apply it this week, close outbound port 445 if it is open, and the same trick will not work against you again.
Sources
- CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability — Microsoft Security Response Center
- Known Exploited Vulnerabilities Catalog — CISA
- Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft — SecurityWeek
- Protected Users security group — Microsoft Learn
- Sign-in logs in Microsoft Entra ID — Microsoft Learn
