Microsoft confirms exploited Outlook zero-day can expose NTLM hashes

Microsoft confirmed exploitation of Outlook CVE-2026-124194, which can expose NTLMv2 authentication hashes when a user opens a crafted message file; Preview Pane alone is not an attack vector. Apply the November patch, verify fleet coverage, restrict outbound SMB/NTLM and relay paths where feasible, and watch for credential abuse; campaign scope and attribution remain unknown.