Microsoft patches exploited Outlook zero-day, SecurityWeek reports

Opening a malicious message file in Outlook could expose an NTLMv2 authentication hash that attackers could use for impersonation, Microsoft says in an advisory quoted by SecurityWeek. The company says the patched flaw, CVE-2026-124194, has been exploited, but cannot be triggered through the Preview Pane.