[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbRkmfdZ9EPKXFr1rsVPseL-XskQvQ2B_eNh0NXMp8ps":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"eb6b7d6e-28af-48dc-9aa8-143a3ce2a0d4","Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes","microsoft-confirms-hackers-are-exploiting-outlook-0-day-to-steal-windows-authent-369d89","Microsoft has confirmed that hackers are exploiting an Outlook zero-day that can expose Windows authentication information when a user opens a malicious file. Tracked as CVE-2026-124194, the spoofing vulnerability was patched on November 10, 2026. Microsoft marks it “Exploitation Detected” and says it was not publicly disclosed before the update. The flaw carries a CVSS […] The post Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes appeared first on Cyber Security News.","Microsoft has confirmed hackers are exploiting an Outlook zero-day vulnerability, tracked as CVE-2026-124194, that allows them to steal Windows authentication hashes. The vulnerability, patched on November 10, 2026, requires user interaction to open a malicious file, which then connects to an attacker-controlled network location without usual warnings. Successful exploitation discloses the user's NTLMv2 hash, potentially enabling authentication relay and offline password cracking.","Microsoft confirms hackers exploit Outlook 0-day to steal Windows authentication hashes.","https:\u002F\u002Fcybersecuritynews.com\u002Foutlook-0-day-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FOutlook-0-Day-Vulnerability.webp","2026-11-11T02:35:43+00:00","2026-11-11T03:00:21.634149+00:00",9,[17,20,23],{"name":18,"type":19},"Outlook","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Windows Authentication","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2026-124194","Outlook zero-day vulnerability",[21],{"controls":56,"vendors":139},[57,85,113],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,69,77],{"vendor_slug":63,"vendor_name":21,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":86,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":63,"vendor_name":21,"vendor_logo":64,"product_slug":135,"product_name":136,"url":137,"description":138},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[140],{"slug":63,"name":21,"logo_path":64,"roles":141},[142],"affected",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"outlook-zero-day-exploited-to-steal-ntlm-authentication-hashes","Outlook Zero-Day Exploited to Steal NTLM Authentication Hashes","A confirmed zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allowed attackers to steal Windows NTLMv2 authentication hashes simply by getting a user to open a malicious file, which then silently connected to an attacker-controlled server. Because NTLM hashes can be relayed in pass-the-hash attacks or cracked offline to recover plaintext passwords, this exposure can lead to full account compromise without the victim ever knowing. The vulnerability was patched on November 10, 2026, meaning any organization that did not apply the patch promptly remained exposed to active exploitation. This incident illustrates how a single unpatched application can expose foundational Windows authentication credentials across an entire organization.",[148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1187: Forced Authentication","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"MITRE ATT&CK T1187: Forced Authentication":156,"CIS Control 7: Continuous Vulnerability Management (v8)":157,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":158},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; operators subject to NIS2 must have processes to address disclosed vulnerabilities like this Outlook zero-day rapidly to protect their networks.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; a mature flaw remediation process with defined patch SLAs would have ensured this critical Outlook update was deployed before active exploitation began.","This technique describes exactly what occurred — the malicious file forced Outlook to authenticate to an attacker-controlled server, surrendering the user's NTLMv2 hash without explicit user consent.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying the Outlook patch promptly under a formal vulnerability management program would have closed this zero-day exposure before attackers could exploit it.","CIS Control 4 calls for restricting unnecessary protocols and authentication mechanisms; disabling outbound NTLM to untrusted hosts via Group Policy would have prevented the hash from being transmitted even if a user opened the malicious file."]