CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · November 11, 2026 CVE-2026-124194: Outlook Spoofing Is Being Exploited - Update and Check Your Office Version An actively exploited spoofing vulnerability in Outlook affects Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024. CVE-2026-124194 has a CVSS score of 6.5; install the Office security updates from November 10, 2026, and verify the builds in use.

Vendor description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft 365 Apps for Enterprise
Microsoft Office LTSC 2021
Microsoft Office LTSC 2024

CVSS 3.1

6.5 (MEDIUM)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C

Weakness type

CWE-356: Product UI does not Warn User of Unsafe Actions

Published

November 10, 2026

In KEV catalog since

November 10, 2026

US federal deadline

November 24, 2026

Official sources

← All vulnerabilities