CVE-2026-124194mediumunder attackCWE-356

CVE-2026-124194: medium-severity vulnerability in Microsoft 365 Apps for Enterprise

Microsoft Outlook Spoofing Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Office+ Monitor Microsoft 365 Apps

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 6.5epss 1.6%
from disclosure to weapon1 day
Published on NVDNov 10
1st PoC+1d
CISA KEVNov 10
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · RECOMENDAÇÃO 23/2026 · 22 Oct 2026Recomendação Técnica – Vulnerabilidade no Microsoft Outlookread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-11-24

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

Microsoft Outlook's interface fails to warn users about potentially unsafe actions, which lets an attacker over the network impersonate a trusted sender or source. Users may trust content they should have questioned.

Technical detail

The Microsoft Office Outlook product UI does not warn users about unsafe actions (CWE-356), and an unauthorized remote attacker can exploit this over the network to perform spoofing. The attack vector is network-based and requires no privileges, with a CVSS base score of 6.5 (Medium). The advisory does not detail further preconditions, such as required user interaction, so impact should be assessed against the vendor's official guidance.

Summary generated and translated by AI from the official description.
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
Affected products
Microsoft · Microsoft 365 Apps for EnterpriseMicrosoft · Microsoft Office LTSC 2021Microsoft · Microsoft Office LTSC 2024
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft 365 Apps for Enterprise

In the same product, most dangerous first.

CVE-2023-23397CRITICALMicrosoft Outlook Elevation of Privilege VulnerabilityEPSS 97.2%KEVCVE-2024-21413CRITICALMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 94.7%KEVCVE-2026-21509HIGHMicrosoft Office Security Feature Bypass VulnerabilityEPSS 70.8%KEVCVE-2021-42292HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 43.0%KEVCVE-2023-36761MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 19.6%KEVCVE-2023-35311HIGHMicrosoft Outlook Security Feature Bypass VulnerabilityEPSS 15.5%KEV