Security advisory
Microsoft Outlook spoofing vulnerability exploited in the wild (CVE-2026-124194)
Status: Investigating. On November 10, 2026, Microsoft disclosed CVE-2026-124194, a flaw in Microsoft Outlook where opening a specially crafted file can make Outlook connect to an attacker-controlled location without its usual warning, exposing the user's NTLMv2 password hash. It is rated medium (CVSS 3.1 score 6.5), but Microsoft reports active exploitation and CISA added it to its Known Exploited Vulnerabilities catalog. The Canadian Centre for Cyber Security covered it in advisory AV26-1142.
Summary
On November 10, 2026, Microsoft disclosed CVE-2026-124194, a flaw in Microsoft Outlook where opening a specially crafted file can make Outlook connect to an attacker-controlled location without its usual warning, exposing the user's NTLMv2 password hash. It is rated medium (CVSS 3.1 score 6.5), but Microsoft reports active exploitation and CISA added it to its Known Exploited Vulnerabilities catalog. The Canadian Centre for Cyber Security covered it in advisory AV26-1142.
CVE: CVE-2026-124194
Status: Investigating
Nimble is reviewing whether any of its products, services or systems are affected. Nimble is checking the Microsoft Outlook and Microsoft 365 Apps installations used by its staff and in its business systems, and the update status of those installations.
This advisory will be updated when the review is complete.
References
- Canadian Centre for Cyber Security, Advisory AV26-1142: cyber.gc.ca
- CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-124194: cisa.gov
- Microsoft Security Response Center, CVE-2026-124194: msrc.microsoft.com
Questions about this advisory? Contact security@nimble.ca.
Back to the Trust Center