Microsoft Outlook: spoofing vulnerability (CVE-2026-124194) exploited in the wild, fix released · ReconX Watchtower
Microsoft has released fixes for a spoofing vulnerability in Microsoft Outlook, tracked as CVE-2026-124194, which affects Microsoft 365 Apps and Office LTSC 2021 and 2024. An attacker who gets a user to open a crafted message file can capture that user's NTLMv2 hash and sign in as them. Microsoft reports exploitation, and CISA lists the flaw as known exploited. Installing the Office updates released on 10/11/2026 is the only vendor fix, and affected users' credentials should be reset if exploitation is suspected.