Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch

TL;DR

Microsoft fixed an actively exploited Outlook zero-day, CVE-2026-124194, in its November 2026 Patch Tuesday release on November 10. The spoofing flaw carries a CVSS score of 6.5. On the same day, CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until November 24 to patch.

Attackers exploited a flaw in Microsoft Outlook that fails to warn users before unsafe actions. Microsoft has released fixes for Microsoft 365 Apps and Office LTSC 2021 and 2024. Apply the November Office updates now.

Why It Matters

This is the only exploited zero-day in this month’s release. Its moderate score hides the real risk. In fact, Microsoft’s CVSS vector marks exploit code maturity as “High,” meaning working attack code exists. CISA’s own assessment in the CVE record also lists exploitation as “active.”

So far, Microsoft has not said who is behind the attacks or how many targets were hit. It has also not credited any researcher for the find.

How the Attack Works

Microsoft describes the bug in one line. The “product UI does not warn user of unsafe actions in Microsoft Office Outlook,” which “allows an unauthorized attacker to perform spoofing over a network.” The weakness maps to CWE-356.

In practice, this means Outlook skips a warning that should appear before a risky step. As a result, a user may trust content that is not what it seems. The attack needs no login, but it does require the target to take some action. Microsoft has not said what that action is. The vector rates confidentiality impact as High, so attackers may steal data this way.

Notably, Microsoft has not shared indicators of compromise or technical details of this Outlook zero-day.

Affected Versions

• Microsoft 365 Apps for Enterprise
• Microsoft Office LTSC 2021, before build 16.0.14334.21048
• Microsoft Office LTSC 2024, before build 16.0.17932.21140

Patch and Mitigation

Install the November 2026 Office security updates on every machine running Outlook. Microsoft 365 Apps users should confirm their update channel has picked up the fix. Meanwhile, remind staff to treat unexpected prompts and links in email with care.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.