CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV

CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. The vulnerability affects Microsoft Office Outlook and is named the Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability. It allows an unauthorised attacker to perform spoofing over a network.

The flaw involves missing user interaction for a potentially unsafe action. The available description identifies spoofing as the impact and a network attack vector; it does not provide further technical detail about the attack conditions or consequences. The vulnerability has a CVSS score of 6.5, rated Medium. A patch is available through Microsoft’s security advisory.

KEV inclusion indicates that active exploitation has been confirmed. The supplied data does not confirm ransomware use; its status is unknown. CISA’s remediation deadline for this entry is 24 November 2026.

CISA requires organisations to apply mitigations in accordance with vendor instructions and follow applicable BOD 26-04 guidance on prioritising security updates, along with CISA’s Forensics Triage Requirements. For cloud services, organisations should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must evaluate each asset’s internet exposure and comply with BOD 26-04 patching guidance.

This requirement directly applies to Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and take appropriate remediation action.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-124194) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.