[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMbPHoft5eyF1Sl-D7gdz7OYT3gIkUSJfzgDvonSxjPY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"40b0d49e-4060-4b88-86a9-a4d6a4fcdce1","outlook-zero-day-exploited-to-steal-ntlm-authentication-hashes","eb6b7d6e-28af-48dc-9aa8-143a3ce2a0d4","Outlook Zero-Day Exploited to Steal NTLM Authentication Hashes","A confirmed zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allowed attackers to steal Windows NTLMv2 authentication hashes simply by getting a user to open a malicious file, which then silently connected to an attacker-controlled server. Because NTLM hashes can be relayed in pass-the-hash attacks or cracked offline to recover plaintext passwords, this exposure can lead to full account compromise without the victim ever knowing. The vulnerability was patched on November 10, 2026, meaning any organization that did not apply the patch promptly remained exposed to active exploitation. This incident illustrates how a single unpatched application can expose foundational Windows authentication credentials across an entire organization.","**Immediate actions:**\n- Apply the November 10, 2026 Microsoft security update for Outlook on all endpoints without delay.\n- Block outbound NTLM authentication to external\u002Funtrusted hosts at the firewall or via Windows Group Policy (e.g., 'Network Security: Restrict NTLM').\n- Audit recent Outlook activity logs for unexpected outbound SMB or WebDAV connections to external IPs.\n\n**Long-term improvements:**\n- Enforce automated patch deployment with strict SLA timelines (e.g., critical patches within 24–72 hours of release).\n- Migrate away from NTLMv2 toward Kerberos or modern authentication (OAuth\u002FMFA) wherever possible to reduce hash-theft impact.\n- Maintain a continuously updated software asset inventory so vulnerable Outlook versions can be identified and prioritized instantly.\n\n**Detection measures:**\n- Deploy network monitoring rules to alert on outbound SMB (port 445) or WebDAV traffic from endpoint workstations to external addresses.\n- Enable and centralize Windows Security event logs (Event ID 4624, 4648) to detect NTLM relay or unusual authentication patterns.\n- Integrate threat intelligence feeds into your SIEM to flag exploitation attempts targeting this CVE in real time.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1187: Forced Authentication","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"MITRE ATT&CK T1187: Forced Authentication":20,"CIS Control 7: Continuous Vulnerability Management (v8)":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":22},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; operators subject to NIS2 must have processes to address disclosed vulnerabilities like this Outlook zero-day rapidly to protect their networks.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; a mature flaw remediation process with defined patch SLAs would have ensured this critical Outlook update was deployed before active exploitation began.","This technique describes exactly what occurred — the malicious file forced Outlook to authenticate to an attacker-controlled server, surrendering the user's NTLMv2 hash without explicit user consent.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying the Outlook patch promptly under a formal vulnerability management program would have closed this zero-day exposure before attackers could exploit it.","CIS Control 4 calls for restricting unnecessary protocols and authentication mechanisms; disabling outbound NTLM to untrusted hosts via Group Policy would have prevented the hash from being transmitted even if a user opened the malicious file.","published","2026-11-11T03:20:25.127672+00:00","2026-11-11T03:20:25.116+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Foutlook-0-day-vulnerability\u002F","microsoft-confirms-hackers-are-exploiting-outlook-0-day-to-steal-windows-authent-369d89","Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"57f63a53-c1c1-4426-95c9-bdaae2cef135","2026-11-11","morning","ThreatNoir Morning Brief — November 11","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-11\u002Fthreatnoir-morning-brief-2026-11-11.mp3",[51,55,58],{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":40,"name":56,"problem":57},"Automated patch management","Known holes get closed in days, not months.",{"slug":59,"name":60,"problem":61},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]