[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fncq7GhrK7RZtTGKknw2x-qCsGAcr8iStyrT3Qoo4uq4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"d74a9706-af1b-48b2-aaeb-20547021c221","actively-exploited-outlook-zero-day-highlights-urgency-of-prompt-patching","54fcd653-4f95-4976-8d94-006237fb3875","Actively Exploited Outlook Zero-Day Highlights Urgency of Prompt Patching","An actively exploited zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allows unauthenticated attackers to steal NTLMv2 credential hashes simply by tricking a user into opening a malicious file. Because the flaw was being exploited before a patch was available, organizations relying on routine monthly patching cycles were left exposed during the window between discovery and remediation. NTLMv2 hash theft is particularly dangerous as it enables pass-the-hash and relay attacks that can facilitate lateral movement across a network. The scale of November's Patch Tuesday — 1,094 vulnerabilities — underscores that vulnerability backlogs remain a persistent and systemic risk. Prioritizing zero-days and actively exploited flaws for emergency patching is essential to reducing attacker dwell time.","**Immediate actions:**\n- Apply Microsoft's November 2026 Patch Tuesday updates immediately, prioritising CVE-2026-124194 for all Microsoft 365 Apps for Enterprise and Office LTSC installations.\n- Enable NTLM relay protections (e.g., EPA, SMB signing) to limit the impact of any NTLMv2 hash disclosures while patching is completed.\n- Block outbound NTLM authentication to untrusted external hosts at the network perimeter as a short-term compensating control.\n\n**Long-term improvements:**\n- Establish a risk-based patching policy that mandates emergency out-of-band patching for any vulnerability rated actively exploited, regardless of CVSS severity score.\n- Maintain a continuously updated software asset inventory so every affected endpoint is identified and patched within hours of a critical advisory.\n- Evaluate and enforce Credential Guard or restricting NTLM usage across the environment to structurally reduce hash-theft attack surface.\n\n**Detection measures:**\n- Monitor for suspicious NTLM authentication events and anomalous outbound SMB or HTTP traffic that may indicate hash-relay attempts.\n- Alert on the opening of unexpected Office file types from external or untrusted sources, particularly those triggering network callbacks.\n- Subscribe to Microsoft's Security Update Guide and threat intelligence feeds to receive real-time notification of active exploitation status changes.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1187: Forced Authentication",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"MITRE ATT&CK T1187: Forced Authentication":20,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This point requires security in acquisition, development and maintenance including vulnerability handling and disclosure, obligating organisations to have processes that act rapidly on actively exploited vulnerabilities like this Outlook zero-day.","SI-2 mandates identifying, reporting, and correcting system flaws within organisation-defined timeframes, directly covering the need for rapid deployment of this Outlook patch.","CVE-2026-124194 exploits the forced authentication technique by coercing the victim's client into leaking NTLMv2 hashes when a malicious file is opened.","This category calls for mitigating the effects of detected incidents, which includes applying compensating controls (such as blocking outbound NTLM) while a patch is deployed for an actively exploited flaw.","CIS Control 7 requires prioritising remediation of actively exploited vulnerabilities, which would have driven emergency patching of CVE-2026-124194 before attackers could leverage it.","published","2026-11-10T20:21:20.790976+00:00","2026-11-10T20:21:20.765+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fexploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft\u002F","exploited-outlook-zero-day-among-1-094-flaws-patched-by-microsoft-3ead3c","Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]