Microsoft Office Outlook flaw enables spoofing; exploited in the wild

What happened

Microsoft has disclosed a spoofing vulnerability in Outlook, part of Microsoft Office. The issue comes from the Outlook interface failing to alert users when they are about to take a potentially unsafe action. A remote attacker without valid credentials could use this gap to carry out spoofing over a network. The flaw is classified as CWE-356.

Microsoft tracks the issue in its advisory CVE-2026-124194, titled Microsoft Outlook Spoofing Vulnerability, and reports that it has been exploited. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10, the same day the CVE was published. Details about who is behind the attacks or how many organizations have been targeted are not part of the data available to us.

Who is affected

The flaw affects Microsoft Office Outlook as shipped in the following Microsoft products, in both x64 and x86 editions: Microsoft 365 Apps for enterprise, Office 2021 LTSC, and Office 2024 LTSC.

Specific affected build or version numbers are not listed in the data available to us. Administrators should check the Microsoft advisory to confirm which installations need the update.

How serious is it

The flaw carries a CVSS 3.1 base score of 6.5, which places it in the medium range. Microsoft also rates it as medium in its own advisory. According to the scoring, it can be attacked over a network with low complexity and no privileges, but it requires a user to interact. The main impact is on confidentiality, which is rated high, while integrity and availability are not affected.

The moderate score understates the practical risk somewhat, because the flaw is being actively exploited and is listed in the CISA KEV catalog. No EPSS estimate of exploitation likelihood is available in our data. Whether ransomware operators use the flaw is not known.

What you should do

1. 1Apply the Microsoft security update described in advisory CVE-2026-124194 to all affected Microsoft 365 Apps, Office 2021 LTSC and Office 2024 LTSC installations.
2. 2Prioritize patching given that the flaw is being actively exploited.
3. 3US federal agencies should complete remediation by the CISA due date of 2026-11-24 in line with CISA guidance.
4. 4If the vendor's mitigations cannot be applied, follow CISA's guidance, which includes discontinuing use of the product.
5. 5Monitor the Microsoft advisory for any updates.

Quick facts