Microsoft Outlook spoofing flaw CVE-2026-124194 added to CISA KEV

CISA added the Microsoft Outlook vulnerability CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026, confirming it is being exploited in attacks. The flaw lets an unauthenticated attacker perform spoofing over a network, and US federal agencies have until 24 November 2026 to apply mitigations.

What happened

CISA lists the issue as a missing user interaction for a potentially unsafe action in Microsoft Office Outlook. In plain terms, Outlook does not warn the user before performing an action that should have prompted a warning. Microsoft documents the flaw in its Security Update Guide entry, and NVD published its record on 10 November 2026.

The attacker is described as unauthorized, meaning no account or prior access is needed. The KEV entry does not say who is exploiting the flaw, and CISA lists known ransomware campaign use as unknown.

Am I affected?

NVD lists these products as affected:

• Microsoft 365 Apps
• Microsoft Office 2021
• Microsoft Office 2024

The vulnerable component is Outlook. If your organisation runs Outlook from any of these suites, assume exposure until you have confirmed your build against Microsoft’s guidance. The NVD record does not list fixed versions, so use the Microsoft advisory as the authority for which builds are patched.

Technical details

• Weakness: CWE-356, product UI does not warn the user of unsafe actions.
• CVSS 3.1: 6.5 (Medium), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. That means network-reachable, low complexity, no privileges, user interaction required, with a high confidentiality impact and no integrity or availability impact.
• Exploitation: confirmed by the KEV listing, added 10 November 2026, due date 24 November 2026.
• Ransomware use: unknown according to CISA.

The CVSS rating is only Medium, but it should not drive your priority. Active exploitation matters more than the base score, and KEV status is the signal most patch programmes treat as an override.

Why this matters

This section is our analysis, not new reporting. Spoofing flaws in a mail client are attractive because they turn a routine action, such as opening or interacting with a message, into a trust decision the user never sees. The high confidentiality impact in the CVSS vector suggests the practical risk is disclosure of information rather than code execution, but the public details do not describe the exact exploitation chain, so treat that as an inference.

Because the attack needs a user to interact with content, phishing-style delivery is the realistic path for a typical environment. Organisations with many Outlook desktops and mixed update channels are the most likely to have stragglers.

How to fix CVE-2026-124194

CISA’s required action is to apply mitigations in line with vendor instructions and its BOD 26-04 guidance, or to stop using the product if mitigations are unavailable. Microsoft has not been quoted here on specific fixed builds, so follow the vendor advisory for the exact update.

What to do

1. Open the Microsoft advisory and identify the update or mitigation for each of your Office channels (Microsoft 365 Apps, Office 2021, Office 2024).
2. Treat it as a KEV item: schedule deployment within days rather than the normal monthly cycle, and well before 24 November 2026 if you are a federal agency or follow KEV deadlines.
3. Inventory Outlook versions with your endpoint management tool and list machines that have not taken recent updates.
4. Hunt for suspicious inbound messages that prompted users to take unusual Outlook actions, and for follow-on activity such as unexpected sign-ins or data access from affected users. CISA’s guidance also references forensics triage requirements, so preserve relevant logs.
5. Remind users to report messages that ask them to confirm or approve unexpected actions in Outlook.
6. If you cannot apply the vendor mitigation, follow CISA’s direction and consider restricting use of the product until you can.

What we do not know yet

No attacker has been named, no victims have been disclosed, and no indicators of compromise have been published. The vendor advisory is the place to watch for updates to affected builds and guidance. We will update this article if CISA or Microsoft add details.

Related coverage

• Windows Shell command injection added to CISA KEV (CVE-2026-96951)
• Chrome CVE-2026-125350 use-after-free exploited, added to CISA KEV
• GPUStack auth bypass CVE-2026-102895 added to CISA KEV

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2026-124194
• Microsoft Security Update Guide: CVE-2026-124194
• NVD: CVE-2026-124194