CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Microsoft's security advisory says the flaw, CVE-2026-124194, lets an unauthenticated attacker send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.[2]Microsoft says that opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning[2], which could expose login data that lets the attacker impersonate the user. Microsoft also says the Preview Pane is not an attack vector.[2]SOC Prime reports that the flaw can expose NTLMv2 authentication data and enable credential theft and account impersonation[3]. It also reports that Microsoft rates it Moderate with a CVSS 3.1 score of 6.5.[3]According to SOC Prime, the bug affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.[3]Shattered.io reports that the release fixed 1,094 CVEs on November 10[4], and that this was the only exploited zero-day in the release.[4] Shattered.io also notes that Microsoft has not said who is attacking Outlook, when the attacks began or how widespread they are[4].Jack Bicer of Action1, quoted on DEV Community, said: "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity."[5]According to WindowsForum, Splashtop reports that the fix ships in the Microsoft 365 Apps and Office LTSC 2021 and 2024 security updates and not in the Windows cumulative update[4].