93← Home

CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Headline from Microsoft — Office · compiled from 3 sources

Our analysis · checked against 10 sources

Microsoft patches exploited Outlook spoofing flaw it rates Moderate; victim must open file

On November 10, Microsoft patched CVE-2026-124194, an Outlook spoofing flaw it rates Moderate (CVSS 6.5) that attackers were already exploiting. A victim must open a crafted message file, which can make Outlook contact an attacker's server without its usual warning and leak sign-in data; Microsoft has not disclosed attackers, targets or start date.

The framing"Critical CVEs" does fit the urgency: the flaw was exploited as a zero-day and CISA listed it on November 10. But Microsoft rates it Moderate (CVSS 6.5), and the three Outlook bugs it rated Critical in the same release are not under attack.

What the headline leaves out

  • The attack needs the victim to open a crafted file; what fails is Outlook's external-content warning, not a click.
  • Attackers are already exploiting it. CISA set covered US federal agencies a November 24 deadline to fix it.
  • Three Critical-rated Outlook bugs in the same release are not under attack.
  • Affected: desktop Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024.

What happens next

Covered US federal agencies must remediate by November 24, 2026, and Microsoft's next scheduled release is December 8, 2026. Tenable warns that a stolen NTLMv2 hash can be used to impersonate the victim. Action1's Jack Bicer says damage "grows fast" if the victim is an administrator or a finance user. Splashtop advises installing the patch within 72 hours.

Possible knock-on effects
  • Unpatched Outlook users could leak NTLMv2 hashes, which attackers may reuse to impersonate them in follow-on attacks. That matters most where victims hold admin or finance access. (named expert: Tenable on hash reuse; Jack Bicer (Action1) on admin and finance victims. Watch for: Disclosures of follow-on intrusions tied to CVE-2026-124194, or Microsoft publishing the number of targets)
  • The 14-day federal deadline may push covered agencies to deploy the Office update before routine patch cycles, which could make the update roll out faster across government. (official assessment: CISA KEV listing with a BOD 26-04 deadline of November 24, 2026. Watch for: CISA or agency statements on compliance after November 24)

Sources: MSRC Security Update Guide: CVE-2026-124194 (primary), Tenable: Microsoft November 2026 Patch Tuesday addresses 1093 CVEs, CVE record: CVE-2026-124194, SecurityWeek: Exploited Outlook zero-day among 1,094 flaws patched by Microsoft, Smtpedia: Outlook zero-day CVE-2026-124194 NTLM, Windowsforum: How to patch CVE-2026-124194 in Outlook, Windowsforum: November 2026 Patch Tuesday exploited Outlook zero-day, SecurityOnline: Outlook zero-day CVE-2026-124194, Brandefense: Exploited Outlook CVE-2026-124194, Strix: CVE-2026-124194

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to Tenable, Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, including one Microsoft Outlook zero-day flaw (CVE-2026-124194) that was exploited.[1]

Microsoft's advisory says that an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.[2] According to Microsoft, opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information[2] that could be used to impersonate the user.Tenable reports that a successful attack would allow an attacker to obtain the target's valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks.[1] In answer to whether the Preview Pane is an attack vector, Microsoft says "No, the Preview Pane is not an attack vector."[2]SecurityOnline reports that CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until November 24 to patch.[3] The outlet says Microsoft's CVSS vector marks exploit code maturity as "High," meaning working attack code exists.[3]According to SecurityOnline, Microsoft has released fixes for Microsoft 365 Apps and Office LTSC 2021 and 2024.[3] The outlet adds that Microsoft has not said who is behind the attacks or how many targets were hit.[3]Tenable reports that the advisory credits this discovery to a security researcher that used Claude, the large language model (LLM) from Anthropic[1].

Listen to the songCritical CVEs (1 of 3) — November 11, 2026

Sources

  1. [1]November 2026 Microsoft Patch Tuesday | Tenable®
  2. [2]CVE-2026-124194 - Security Update Guide - Microsoft - Microsoft Outlook Spoofing Vulnerability
  3. [3]Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | 93