The Cybersecurity and Infrastructure Security Agency has added CVE-2026-124194, an actively exploited Microsoft Outlook spoofing vulnerability, to its Known Exploited Vulnerabilities catalog.
Added on November 10, 2026, the entry establishes a November 24 remediation deadline. The warning follows disclosures about Outlook authentication theft involving malicious message files and unsafe external connections.
Microsoft Outlook Zero-Day Vulnerability
The vulnerability allows an unauthorized attacker to spoof a network. Microsoft’s CVE record assigns a CVSS v3.1 score of 6.5, with low attack complexity, no required privileges, and required user interaction. Its confidentiality impact is rated high, while integrity and availability impacts are rated none in that assessment.
The underlying weakness, CWE-356, concerns missing user interaction before potentially unsafe actions. Microsoft describes Outlook’s failure to warn users about unsafe behavior. Unlike separately disclosed Outlook remote code execution vulnerabilities, this issue is classified as spoofing; the published CVE description does not establish arbitrary code execution as its direct impact.
According to published technical coverage, an attacker sends a specially crafted message file and persuades the recipient to open it. Outlook can then contact an attacker-controlled network location without displaying its usual external-content warning. The official CVE record confirms user interaction is required, making “zero-click” an inaccurate description of this vulnerability.
That outbound connection can expose NTLMv2 authentication information rather than a plaintext password. Captured authentication material may support impersonation through password cracking or relay attacks, depending on environmental protections. Public reporting does not identify the attackers, affected organizations, or campaign scale, and the supplied catalog entry does not indicate ransomware involvement.
Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 across supported 32-bit and x64 configurations. Fixed LTSC builds are 16.0.14334.21048 and 16.0.17932.21140, respectively. Administrators reviewing the November security updates should verify applicable release channels and installed builds rather than assuming every deployment updates simultaneously.
CISA’s supplied instructions require vendor-directed mitigations consistent with BOD 26-04 risk-based patching guidance. Stakeholders must assess each asset’s internet exposure, follow applicable cloud-service guidance, and discontinue affected products when mitigations are unavailable. The entry states that mandatory forensic triage is not required; this does not establish that exploitation left no evidence.
Organizations should prioritize patching despite the moderate severity rating, review suspicious message files, and investigate unexpected outbound authentication. Restricting unnecessary outbound SMB traffic, enforcing SMB signing, and reviewing NTLM exposure can provide supplementary protection. As with other Microsoft Office exploitation campaigns, defensive controls should complement, not replace, deployment of applicable updates.
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:
