CVE-2026-124194: Outlook Spoofing Is Being Exploited - Update and Check Your Office Version

Microsoft released security updates for CVE-2026-124194 on November 10, 2026. The vulnerability in Microsoft Office Outlook allows an unauthenticated attacker to perform spoofing over the network if user interaction occurs. Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and 2024 are affected. NVD rates the vulnerability CVSS 3.1: 6.5 (Medium); Microsoft marks exploitation as detected, and CISA added it to the KEV Catalog on November 10, 2026. Updates are available.

Key points at a glance

Affected versions and updates

For Microsoft 365 Apps for Enterprise, Microsoft lists, among others, these builds on November 10, 2026: Current Channel 20527.20196, Monthly Enterprise Channel 20527.20194, 20430.20264, and 20326.20320, as well as Semi-Annual Enterprise Channel 20527.20192, 20430.20262, and 20326.20318. The applicable build number for a device depends on its update channel. The Office security release notes assign CVE-2026-124194 to Outlook.

What is known about exploitation

Microsoft lists CVE-2026-124194 in the security updates of November 10, 2026, as a case with detected exploitation. CISA considers the vulnerability actively exploited and added it to the KEV Catalog on the same day. The available Microsoft, NVD, and CISA entries contain no information about attackers, target organizations, attack campaigns, or the technical process of exploitation.

CISA marks use in ransomware campaigns as “Unknown.” CISA does not require forensic triage under BOD 26-04 for this KEV entry.

Immediate actions

1. Inventory Office versions: For Microsoft 365 Apps for Enterprise, determine the update channel and installed build number. For Office LTSC 2021 and 2024, compare the version with the fixed builds in the table.

2. Install security updates: Update Microsoft 365 Apps for Enterprise to the security level of November 10, 2026. Update Office LTSC 2021 to at least build 14334.21048 and Office LTSC 2024 to at least build 17932.21140.

3. Document update status: Record the product, architecture, update channel, current build number, and update time for each device. This makes it possible to track the status of affected Office installations.

4. Address installations that cannot be updated: CISA requires U.S. federal agencies to implement vendor measures by November 24, 2026, or discontinue use if no measures are available. For all organizations, this is a reason to replace or retire Office installations that cannot be updated promptly.

The available vendor and government sources do not mention a technical workaround, a configuration change, or a restriction of an Outlook management interface. The measure against this vulnerability is therefore to update the affected Office installation.

Checking for compromise

Microsoft, NVD, and CISA do not publish any indicators of compromise, file names, IP addresses, or log signatures for CVE-2026-124194 in the available sources. Therefore, no source-based IOC search can be specified as of November 11, 2026.

Nevertheless, check the update status of all affected Office installations and retain existing endpoint and email security logs according to your retention policy. The available sources do not describe a backdoor or remediation steps after successful exploitation. An update fixes the vulnerability but does not provide evidence of whether a specific process has already been abused.

Assessment

Affected are organizations and individuals using Outlook within Microsoft 365 Apps for Enterprise or Office LTSC 2021 or 2024. According to the CVSS vector, the vulnerability requires user interaction, but it has no privilege requirement and can be exploited over the network. Its inclusion in the CISA KEV Catalog shows that exploitation is known and that updating is a priority.