Actively Exploited Outlook Flaw Exposes NTLMv2 Hashes — Patch Immediately
Written by AI from the linked story. Not reviewed by an editor. How this works
An actively exploited vulnerability in Microsoft Outlook (CVE-2026-116928) can leak NTLMv2 hashes, enabling attackers to impersonate legitimate users through pass-the-hash or relay attacks without ever needing a plaintext password. This flaw is one of 1,259 addressed in a single Microsoft patch cycle, underscoring how quickly vulnerability debt accumulates when patching is delayed. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that real-world exploitation is already underway, meaning unpatched organizations face immediate risk. Prompt patching combined with NTLMv2 hardening controls is essential to prevent credential theft and lateral movement.
Tactical Insight
Immediate actions
- Apply Microsoft's latest security updates immediately, prioritizing CVE-2026-116928 on all systems running Microsoft Outlook
- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities catalog and treat any match as an emergency patch
Long-term improvements
- Establish a risk-tiered patch management policy that mandates accelerated timelines (e.g., 24–72 hours) for actively exploited vulnerabilities
- Disable or restrict NTLM authentication where possible and enforce NTLMv2 relay protections (e.g., SMB signing, Extended Protection for Authentication)
- Maintain a continuously updated inventory of all software and versions to reduce mean time to patch
Detection measures
- Monitor for anomalous NTLM authentication events and outbound SMB/HTTP requests that could indicate hash capture or relay attempts
- Subscribe to CISA KEV and vendor security advisories to receive real-time alerts when exploited vulnerabilities are disclosed