CVE-2026-124194CVSS 6.5Unsafe-action warning missing
Outlook can fail to warn users before an unsafe action, enabling spoofing.
Microsoft patches exploited Outlook spoofing flaw in Windows Office
Microsoft documents an Outlook interface that omits a warning for an unsafe action. The network attack requires user interaction and is in CISA KEV. Install the November security update for your Office edition and channel.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- CVSS 6.5
- 1 CVE tracked here
- Splash zone
- Windows Outlook in Office LTSC 2021/2024 and Microsoft 365 Apps for Enterprise, x86 and x64.
- Outlook · Office · credential exposure
- In the wild
- Yes
- CISA listed CVE-2026-124194 as known exploited on November 10.
What happened
The Microsoft CNA record describes a missing warning that allows spoofing over a network. Its CVSS 3.1 vector requires user interaction and no attacker privileges. The record does not establish the exact lure, a zero-click path or victim scope. For Microsoft 365 Apps for Enterprise use the Office security release table for your channel.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Office LTSC 2021 | 16.0.14334.21048 | |
| Office LTSC 2024 | 16.0.17932.21140 |
Crime-scene timeline
Nov 10, 2026
Microsoft discloses the flaw and CISA lists it in KEV
CISA lists November 24 as the deadline for applicable U.S. federal civilian agencies.
Nov 11, 2026
Microsoft updates its CVE record
The record lists the LTSC build thresholds and refers Microsoft 365 customers to the channel release table.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Microsoft CNA recordPrimaryLists affected Windows Office products, user interaction in the CVSS vector and LTSC build thresholds.
- CISA KEV catalogPrimaryConfirms known exploitation and the listed federal remediation deadline.