Hackers are actively exploiting a vulnerability in Microsoft Outlook that exposes user password hashes. Microsoft patched the issue, identified as CVE-2026-124194, during its November Patch Tuesday release. The attack involves sending a crafted message file that causes Outlook to connect to an attacker-controlled server, leaking NTLMv2 hashes. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the fix by November 24. The vulnerability affects several Office versions and requires users to open the malicious file to trigger the exploit.
Read the full story at cisovoice.com.
Photo: MrJayW / Pixabay
