CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
Vendor fix available · Affected: Microsoft 365 Apps for Enterprise · Exploitation: in CISA KEV since 10 Nov
Action brief
Patch
KEV status
In CISA KEV since 10 Nov; federal deadline 24 Nov.
Why this CVE
CISA added it to KEV on 10 Nov. Briefs cover CVEs that CISA added to its Known Exploited Vulnerabilities catalogue in the last 30 days, or that at least 5 outlets covered within 72 hours.
No written summary yet. The sections above come straight from stored records.
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue10 Nov
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
No EPSS score yet. The score appears once FIRST publishes it.
Federal deadline
CISA KEV · added 10 Nov · catalogue entry
14d3h13mleft
First in our coverage 10 Nov (SecurityWeek), the day CISA added it to KEV.
- In CISA KEV
- Remediation window
- Article
DescriptionNVD
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
What changed
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityWeek, 10 Nov.
- Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
- Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 10 Nov 19:30 | SecurityWeek | Microsoft patches Outlook zero day exploited in the wild |
| 10 Nov 20:31 | CISA | CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV |
- CISA Adds Actively Exploited Outlook Spoofing Flaw to KEVCISA · official notice
- Microsoft patches Outlook zero day exploited in the wildSecurityWeek · first in our coverage
New articles also arrive in the RSS feed.