CVE-2026-124194
Microsoft Outlook spoofing flaw allows unauthorized network spoofing
Microsoft Outlook fails to warn users about unsafe actions, allowing an attacker to send spoofed emails over a network. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021. It is under active exploitation, but Microsoft has released patches in its November 2026 security updates.
Microsoft Microsoft 365 Apps for Enterprise · Updated 11 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 10 Nov; US agencies must fix by 24 Nov
SeveritymediumCVSS 6.5 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Microsoft 365 Apps for Enterprise https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2024 16.0 | 16.0.17932.21140 |
| Microsoft Office LTSC 2021 16.0 | 16.0.14334.21048 |
What to do
- Install the latest security updates: for Microsoft 365 Apps for Enterprise, update via the Office Security Releases; for Office LTSC 2024, upgrade to version 16.0.17932.21140; for Office LTSC 2021, upgrade to version 16.0.14334.21048.
- U.S. federal agencies must apply the patch by November 24, 2026 per CISA.
- Prioritize this update because attackers are actively exploiting the flaw.
What happened
- 10 NovCISA adds CVE-2026-124194 to its Known Exploited Vulnerabilities Catalog.
- 10 NovMicrosoft releases November 2026 Patch Tuesday updates that fix the Outlook spoofing vulnerability.
- 11 NovZotpaper reports the vulnerability is the only zero-day under active exploitation in the November patch.
- 24 NovDeadline for US federal agencies to apply the fix per CISA.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | medium 6.5 | 10 Nov | — |
Our reporting
11 NovMicrosoft's November patch release fixes 1,094 flaws, including exploited Outlook zero-dayReported elsewhere
www.theregister.com - Articles · 10 NovNovember Patch Tuesday boasts over 1,000 bugs but only one zero-day so far ↗Rapid7 · 10 NovPatch Tuesday - November 2026 ↗Rapid7 · 10 NovPatch Tuesday - November 2026 ↗Krebs on Security · 10 NovMicrosoft Fixes Nearly 1,100 Security Vulnerabilities ↗BleepingComputer · 10 NovMicrosoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day ↗CISA · 10 NovCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
msrc.microsoft.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-124194 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free