CISA has added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog. It is a Microsoft Office Outlook spoofing flaw, and federal agencies must remediate it by November 24, 2026.
What Is It
CVE-2026-124194 is a "missing user interaction for potentially unsafe action" vulnerability (CWE-356) in Microsoft Office Outlook. According to NVD, the product UI does not warn the user about unsafe actions. This allows an unauthorized attacker to perform spoofing over a network.
Microsoft scored it CVSS 3.1 6.5 (MEDIUM) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Exploitation happens over the network and has low complexity. The attacker needs no privileges, but a user must interact. The impact is to confidentiality (High), with none to integrity or availability.
Why It Matters
CISA's KEV listing confirms active exploitation. CISA added the CVE on 2026-11-10, the same day NVD published it. CISA's SSVC assessment rates exploitation as active, automatability as no, and technical impact as partial.
The base score is only medium, but confirmed in-the-wild use moves this flaw ahead of routine Office patching. Outlook is a common, high-volume attack surface. A flaw that removes the warning before an unsafe action weakens a safeguard that users rely on. KEV lists ransomware campaign use as Unknown.
What's Vulnerable
NVD lists the following affected products on 32-bit and x64-based systems:
- Microsoft 365 Apps for Enterprise: affected from 16.0.1. The fixed build is tracked at https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021: 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 up to, but not including, 16.0.17932.21140
Patch Status
Microsoft has published a vendor advisory in the MSRC Update Guide. NVD's affected-version data gives fixed build boundaries for both LTSC releases. For Microsoft 365 Apps for Enterprise, it points to Microsoft's Office security release page.
CISA required action: Apply mitigations in accordance with vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." Follow the applicable BOD 26-04 guidance for cloud services. If mitigations are unavailable, discontinue use of the product. Stakeholders must assess each asset's internet exposure. KEV marks forensic triage for this entry as No.
Due date: 2026-11-24.
Organizations running affected Office builds should confirm their Outlook clients are at or above the fixed versions listed above.