CVE-2026-124194: Forced Authentication and NetNTLMv2 Credential Leakage in Microsoft Office Outlook

Vulnerability ID: CVE-2026-124194
CVSS Score: 6.5
Published: 2026-11-10

CVE-2026-124194 is a forced authentication and spoofing vulnerability in Microsoft Office Outlook caused by a missing user interface warning before dereferencing remote network paths (CWE-356). By embedding an attacker-controlled Universal Naming Convention (UNC) path within MAPI message properties such as PidLidReminderFileParameter, an unauthenticated remote attacker can force a victim's system to initiate an outbound SMB or WebDAV connection upon opening or previewing a crafted message. This automatic authentication handshake leaks the user's NetNTLMv2 hash, enabling offline password cracking or real-time NTLM relay attacks. The vulnerability was exploited in the wild as a zero-day prior to its remediation in Microsoft's November 2026 Patch Tuesday updates and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

TL;DR

Microsoft Office Outlook fails to warn users before dereferencing external UNC paths specified in MAPI message properties (CWE-356). Opening or previewing a crafted .msg file forces the underlying Windows OS to authenticate over SMB to an attacker-controlled server, leaking NetNTLMv2 credential hashes. The flaw is actively exploited in the wild.

⚠️ Exploit Status: ACTIVE

Technical Details

• Vulnerability Class: CWE-356: Product UI does not Warn User of Unsafe Actions (Forced Authentication)
• Attack Vector: Network (Crafted .msg email attachment or Outlook item containing UNC path)
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
• Trigger Property: PidLidReminderFileParameter (MAPI Tag 0x851F / Stream __substg1.0_851F001F)
• Primary Impact: Outbound SMB/WebDAV forced authentication leaking NetNTLMv2 credential hashes
• Exploit Status: Actively exploited in the wild (Zero-Day) with public PoC available
• CISA KEV Status: Listed (Added 2026-11-10, Remediation Due 2026-11-24)

Affected Systems

• Microsoft 365 Apps for Enterprise (x64)
• Microsoft 365 Apps for Enterprise (x86)
• Microsoft Office LTSC 2024 (x64)
• Microsoft Office LTSC 2024 (x86)
• Microsoft Office LTSC 2021 (x64)
• Microsoft Office LTSC 2021 (x86)
• Microsoft 365 Apps for Enterprise: >= 16.0.1, < November 2026 Security Update (Fixed in: November 10, 2026 Security Update)
• Microsoft Office LTSC 2024: >= 16.0.0, < 16.0.17932.21140 (Fixed in: 16.0.17932.21140)
• Microsoft Office LTSC 2021: >= 16.0.1, < 16.0.14334.21048 (Fixed in: 16.0.14334.21048)

Exploit Details

• GitHub: Proof-of-Concept generator that builds a valid MS-CFB .msg file embedding a UNC path in PidLidReminderFileParameter (0x851F) along with a standalone SMB NTLMv2 listener.

Mitigation Strategies

• Apply Microsoft November 2026 Patch Tuesday security updates across all Microsoft 365 Apps and Office LTSC installations.
• Block outbound SMB traffic (TCP ports 445 and 139, UDP ports 137 and 138) at enterprise perimeter firewalls and via host-based firewall rules on roaming endpoints.
• Restrict outgoing NTLM authentication traffic to remote servers via Windows Group Policy (Restrict NTLM: Outgoing NTLM traffic to remote servers).
• Enforce SMB signing and LDAP channel binding across all internal servers to prevent captured NTLM credentials from being relayed.
• Place privileged accounts into the Active Directory Protected Users security group to disable NTLM authentication for high-value targets.
• Disable the Windows WebClient service on endpoints where WebDAV functionality is not required to prevent HTTP-based forced authentication fallback.

Remediation Steps:

1. Inventory all endpoints running Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2024, and Microsoft Office LTSC 2021.
2. Update Microsoft Office LTSC 2024 installations to build 16.0.17932.21140 or higher.
3. Update Microsoft Office LTSC 2021 installations to build 16.0.14334.21048 or higher.
4. Ensure Microsoft 365 Apps for Enterprise deployments receive the November 10, 2026 channel update.
5. Configure Group Policy setting 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to 'Deny all' or 'Deny all domain accounts'.
6. Verify perimeter firewall rules block outbound TCP 445/139 to non-RFC1918 destinations and inspect email gateways using YARA rules for .msg files containing stream '__substg1.0_851F001F' with UNC paths.

References

• Microsoft Security Update Guide Advisory: CVE-2026-124194
• CISA Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-124194
• National Vulnerability Database (NVD) Entry: CVE-2026-124194
• CVE Record on CVE.org: CVE-2026-124194
• GitHub PoC Repository: AmesianX/CVE-2026-124194-poc
• BleepingComputer Coverage: Microsoft November 2026 Patch Tuesday

Read the full report for CVE-2026-124194 on our website for more details including interactive diagrams and full exploit analysis.