- Description
- Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- 365_apps, office_2021, office_2024
CVSS 3.1
- Type
- Secondary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
Data from CISA
- Vulnerability name
- Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- Exploit added on
- Nov 10, 2026
- Exploit action due
- Nov 24, 2026
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- secure@microsoft.com
- CWE-356
- Hype score
- Not currently trending
会社でOutlookを使っているなら、Officeの更新が実際に完了しているか確認を。Microsoftが悪用を確認したCVE-2026-124194は、製品名と更新経路を確かめ、対応する修正が端末に入ったことまで点検するのが要点です。
@ideomix
10 Nov 2026
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Microsoft Microsoft 365 Apps for Enterprise / Microsoft Microsoft Office LTSC 2021 / Microsoft Microsoft Office LTSC 2024 — CVE-2026-124194 Source : 10/11/2026 Analyse et sources : https://t.co/9WrOcUCEc3 #NADEG #UNITE99
@UNITE99FR
10 Nov 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
おはようさん！11/11朝の脆弱性まとめやで。昨夜はMSの月例パッチの日やったし、CISAのKEVも2026.11.10版に更新されとるわ。 1. Microsoft Outlook（CVE-2026-124194） ・対象：Microsoft 365 Apps for Enterprise、Office LTSC 2021/2024 ・
@yabetchi_iPhone
10 Nov 2026
8 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
対象はOutlook（M365 Apps、Office LTSC 2021/2024）。MS月例で悪用中の脆弱性。 Microsoftが11/10（米国時間）公開。 ✅CVE-2026-124194 は悪用を確認 ✅細工ファイルを開くと警告なしで外部に接続し、認証情報が漏れる恐れ
@SuperIntelSE
10 Nov 2026
23 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
IT Security Brief: Outlook zero-day, CVE-2026-124194 Microsoft patched an Outlook flaw today that attackers are already using. In plain terms: someone emails you a specially built message file. If you open it, Outlook quietly reaches out to a server the attacker controls, and
@RFolmes
10 Nov 2026
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Testing out GrokBot for threat intel alerts. TLP:CLEAR · Alert · Nov 10, 2026, about 12:10 PM PT Outlook zero-day CVE-2026-124194, fixed on Patch Tuesday (exploited, added to KEV) Affected products: Microsoft 365 Apps for Enterprise (32- and 64-bit) and Office LTSC 2021 and
@GsInfosystems
10 Nov 2026
61 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Microsoft's November Patch Tuesday fixes more than 1,000 vulnerabilities, including an exploited Outlook zero-day. CVE-2026-124194 is rated Moderate, with a CVSS score of 6.5. Microsoft confirms active exploitation. The vulnerability is classified as spoofing. An attacker can h
@cytexsmb
10 Nov 2026
55 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
【注意】OutlookのなりすましCVE-2026-124194が悪用済(CISA KEV)。M365 Apps/Office LTSCに11月更新を適用。 Outlook spoofing CVE-2026-124194 exploited (CISA KEV). Install Nov 2026 updates for Microsoft 365 Apps/Office LTSC 2021/2024. https://t.co/bilUaivpsW
@ZeroKaiLabs
10 Nov 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 MICROSOFT: OUTLOOK FLAW CVE-2026-124194 EXPLOITED, PATCH OFFICE NOW Microsoft has patched an Outlook spoofing flaw that it says is already being exploited. If a user opens a crafted message file, Outlook can connect to an attacker-controlled location without showing the usu
@DailyDarkWeb
10 Nov 2026
3372 Impressions
3 Retweets
7 Likes
2 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2026-124194 | Microsoft Outlook Spoofing no Outlook (Microsoft 365 Apps e Office LTSC 2024/2021). Abrir um arquivo de mensagem malicioso faz o Outlook conectar ao servidor do atacante sem aviso e pode vazar dados de autenticação. CVSS 6.5, explorada, no KEV desde 10/
@arcsectec
10 Nov 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
JUST IN: CISA adds 6 exploited flaws to KEV: Microsoft Outlook (CVE-2026-124194), Cisco BroadWorks XXE (CVE-2026-20320), Openwave Webtop Media Transcoder (CVE-2026-111793), two Barracuda ESG bugs (federal deadline Nov 13) and Chrome CVE-2026-125350. https://t.co/WbYqiVmjFZ
@CipherSecurityN
10 Nov 2026
40 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
"matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
"matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*",
"matchCriteriaId": "1D518075-3362-4D15-93B1-0E6C61518D16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*",
"matchCriteriaId": "1059BEC6-C30B-4F0F-A878-5267A21CBD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*",
"matchCriteriaId": "55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*",
"matchCriteriaId": "8887D177-26A3-4008-89B6-50A9E9830F13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]