The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194 — an actively exploited Microsoft Outlook spoofing vulnerability — to its Known Exploited Vulnerabilities catalog on November 10, 2026, and established a November 24 remediation deadline. The warning follows disclosures that specially crafted message files and unsafe external connections can lead to authentication theft.
Microsoft Outlook impact and technical details
CVE-2026-124194 is classified as a spoofing vulnerability that allows an unauthorized attacker to spoof a network. Microsoft’s CVE entry assigns a CVSS v3.1 score of 6.5, noting low attack complexity, no required privileges and required user interaction; confidentiality impact is rated high, while integrity and availability impacts are rated none. The underlying weakness is tracked as CWE-356, a missing user interaction before potentially unsafe actions. Microsoft says Outlook can fail to warn users about unsafe behavior, and the published CVE description does not state arbitrary code execution as a direct impact, distinguishing this issue from separately disclosed Outlook remote code execution vulnerabilities.
Published technical coverage and Microsoft’s record describe an attack where an adversary sends a specially crafted message file and persuades a recipient to open it. Outlook may then contact an attacker-controlled network location without displaying its usual external-content warning. The official CVE confirms that user interaction is required, making “zero-click” an inaccurate description. That outbound connection can expose NTLMv2 authentication material rather than a plaintext password; captured authentication data may enable impersonation through password cracking or relay attacks depending on environmental protections.
Public reporting has not identified the attackers, affected organizations or the scale of any campaign, and the supplied catalog entry does not indicate ransomware involvement.
Affected products, fixes and CISA guidance
Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 on supported 32-bit and x64 configurations. Fixed LTSC builds are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. Administrators reviewing November security updates are advised to verify applicable release channels and installed builds rather than assuming all deployments update simultaneously.
CISA’s catalog entry requires vendor-directed mitigations consistent with BOD 26-04 risk-based patching guidance. Stakeholders must assess each asset’s internet exposure, follow applicable cloud-service guidance and discontinue affected products when mitigations are unavailable. The entry states that mandatory forensic triage is not required; this statement does not establish that exploitation would leave no evidence.
Organizations should prioritize applying available patches despite the moderate CVSS rating, review suspicious message files and investigate unexpected outbound authentication attempts. Restricting unnecessary outbound SMB traffic, enforcing SMB signing and reviewing NTLM exposure are suggested supplementary protections. As with other Microsoft Office exploitation campaigns, defensive controls should complement — not replace — deployment of applicable updates.
