[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAraKHrfOidZMOUXew18WeSU27li2PzUOWILfP4RS1mE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"ef323878-ef71-47e6-b45c-83539475d86a","actively-exploited-outlook-flaw-exposes-ntlmv2-hashes-patch-immediately","4e65bb81-858c-457a-b49e-214fca6e26f7","Actively Exploited Outlook Flaw Exposes NTLMv2 Hashes — Patch Immediately","An actively exploited vulnerability in Microsoft Outlook (CVE-2026-116928) can leak NTLMv2 hashes, enabling attackers to impersonate legitimate users through pass-the-hash or relay attacks without ever needing a plaintext password. This flaw is one of 1,259 addressed in a single Microsoft patch cycle, underscoring how quickly vulnerability debt accumulates when patching is delayed. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that real-world exploitation is already underway, meaning unpatched organizations face immediate risk. Prompt patching combined with NTLMv2 hardening controls is essential to prevent credential theft and lateral movement.","**Immediate actions:**\n- Apply Microsoft's latest security updates immediately, prioritizing CVE-2026-116928 on all systems running Microsoft Outlook\n- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities catalog and treat any match as an emergency patch\n\n**Long-term improvements:**\n- Establish a risk-tiered patch management policy that mandates accelerated timelines (e.g., 24–72 hours) for actively exploited vulnerabilities\n- Disable or restrict NTLM authentication where possible and enforce NTLMv2 relay protections (e.g., SMB signing, Extended Protection for Authentication)\n- Maintain a continuously updated inventory of all software and versions to reduce mean time to patch\n\n**Detection measures:**\n- Monitor for anomalous NTLM authentication events and outbound SMB\u002FHTTP requests that could indicate hash capture or relay attempts\n- Subscribe to CISA KEV and vendor security advisories to receive real-time alerts when exploited vulnerabilities are disclosed",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"MITRE ATT&CK T1557: Adversary-in-the-Middle":20,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This point requires security measures covering vulnerability handling and disclosure in acquisition, development, and maintenance, which includes applying vendor patches promptly for exploited flaws like this Outlook bug.","SI-2 mandates identifying, reporting, and correcting information system flaws within organizationally defined time frames, directly addressing the need to patch CVE-2026-116928 on an emergency basis.","Capturing NTLMv2 hashes via this Outlook vulnerability enables relay and adversary-in-the-middle attacks, the exact technique this ATT&CK entry describes, making credential relay detection critical.","Applying CISA's KEV catalog as an authoritative signal and acting on it represents the kind of threat-intelligence-driven response that this category calls for when known exploitation is confirmed.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which would have driven timely patching of this actively exploited Outlook flaw before attackers could leverage it.","published","2026-11-11T09:20:58.943968+00:00","2026-11-11T09:20:58.929+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fmicrosoft-patches-1259-flaws-including.html","microsoft-patches-1-259-flaws-including-exploited-outlook-bug-that-may-expose-nt-b4b549","Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":40,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]