Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes

Microsoft has confirmed that hackers are exploiting an Outlook zero-day that can expose Windows authentication information when a user opens a malicious file.

Tracked as CVE-2026-124194, the spoofing vulnerability was patched on November 10, 2026. Microsoft marks it “Exploitation Detected” and says it was not publicly disclosed before the update.

The flaw carries a CVSS score of 6.5 and a Moderate severity rating. However, confirmed attacks make it a patching priority. Microsoft’s Exploitability Index states that “Exploitation Detected” means the company knows of actual exploitation, not just that attackers could develop a working exploit.

Outlook 0-Day Vulnerability

An attacker does not need an account or prior access to the target’s system. Instead, they send a specially crafted message file and convince the recipient to open it in an affected Outlook version. Successful exploitation requires both user interaction and network connectivity.

Opening the…