PatchaPalooza

CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook, rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft reports that it has been exploited in the wild. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 6 products in 1 product family (Microsoft Office).

Key facts

CVE ID
CVE-2026-124194
Severity
Medium CVSS 6.5
Microsoft severity
Moderate
Impact
Spoofing
Exploited in the wild
Yes
Publicly disclosed
No
Exploitation likelihood
Detected
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Microsoft Office

From the November 2026 Patch Tuesday briefing

Outlook spoofing under active exploitation

Exploited in the wild, this medium-severity Microsoft Office flaw enables Outlook spoofing over the network without sign-in, but requires user action. Its exploitation status puts it ahead of higher-scoring flaws in deployment priority. The weakness is CWE-356, product UI failing to warn users of unsafe actions. CVSS: 6.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-124194 at 6.5 (temporal 6.2) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
Exploit code maturityHigh
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.

Is the Preview Pane an attack vector for this vulnerability?

No, the Preview Pane is not an attack vector.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send a user a malicious Office file and convince them to open it.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H). What does that mean for this vulnerability?

This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user.

Affected products (6)

Microsoft Office

ProductSecurity updateTypeFixed buildRestart
Microsoft Office LTSC 2021 for 64-bit editionsRelease NotesSecurity Update16.0.14334.21048
Microsoft Office LTSC 2021 for 32-bit editionsRelease NotesSecurity Update16.0.14334.21048
Microsoft Office LTSC 2024 for 64-bit editionsRelease NotesSecurity Update16.0.17932.21140
Microsoft Office LTSC 2024 for 32-bit editionsRelease NotesSecurity Update16.0.17932.21140
Microsoft 365 Apps for Enterprise for 64-bit SystemsRelease NotesSecurity Updatehttps://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit SystemsRelease NotesSecurity Updatehttps://aka.ms/OfficeSecurityReleases

Acknowledgments

  • Benoît Sevens using Claude with Anthropic
  • nono

Revision history

VersionDateDescription
1.0Information published.

Sources