Outlook CVE-2026-124194: spoofing flaw exploited in the wild

What it is and who is affectedCVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook, catalogued by MITRE as CWE-356, a missing warni...

What it is and who is affected

CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook, catalogued by MITRE as CWE-356, a missing warning to the user about a potentially unsafe action. In practice, the interface does not flag an operation that should raise a red flag, and an unauthorised attacker can use that gap to perform spoofing over a network. The official name is the Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability.

The NVD entry, published on 10 November 2026, rates it at CVSS 3.1 base score 6.5, which is MEDIUM severity. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N: reachable over the network, low attack complexity, no privileges required, but it does require user interaction, and the impact is concentrated on confidentiality rather than integrity or availability.

According to the NVD, the affected products are Microsoft 365 Apps, Microsoft Office 2021 and Microsoft Office 2024. If your organisation runs Outlook through any of those, it falls inside the scope of this advisory. That covers a very large share of Spanish SMEs, online shops and small IT departments, including businesses in Barcelona, Lleida, Tarragona and Girona that rely on Microsoft 365 for day-to-day email.

Why it is urgent: already exploited in real attacks

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, which means there is evidence of exploitation in real attacks. The same catalogue entry gives US federal agencies until 24 November 2026 to remediate it.

That two-week window is a useful benchmark for everyone else. When a vendor advisory and a KEV listing line up, the practical question for a business is no longer whether the flaw matters, but how quickly it can be closed. Note that the material does not record this CVE as used in ransomware campaigns, so the urgency here comes from active exploitation and the spoofing risk, not from a known ransomware link.

Spoofing matters more than its MEDIUM score suggests. When Outlook fails to warn about an unsafe action, an attacker can make a message or an operation look legitimate, and the confidentiality impact is rated high. In a commercial context, that is the doorway to credential harvesting, invoice fraud and business email compromise, all of which hit SMEs and ecommerce operators hard and are costly under GDPR obligations.

What to do today

Confirm whether you use the product and which version. Check your Microsoft 365 Apps channel, Office 2021 or Office 2024 installations, including the laptops of sales and finance staff who work outside the office.
Apply the vendor guidance. Follow the Microsoft Security Response Center update guide for CVE-2026-124194. The material does not state which build resolves the issue, so take the update or mitigation exactly as the vendor advisory specifies rather than guessing a version number.
Review for signs of intrusion. Look at mailbox rules created unexpectedly, forwarding to external addresses, unusual sign-in locations and messages that appear to come from a trusted supplier or colleague. CISA's action for this CVE also points to forensic triage requirements, which is a sensible checklist even outside the US federal context.
Reduce what is exposed to the internet. CISA asks asset owners to evaluate each asset's internet exposure. Restrict legacy authentication, tighten conditional access and make sure only the mail services you actually need are reachable from outside.

How a cybersecurity team such as ALMC's can help

Keeping track of advisories like this one, across Microsoft 365, WordPress, PrestaShop, Joomla and your own servers, is a job in itself. At ALMC we work with SMEs, online shops and small IT teams that need someone watching the vulnerability landscape on their behalf: security audits and pentesting to find gaps before they are exploited, server hardening, monitoring and incident response when something looks wrong, and maintenance and patching of the platforms your business runs on.

If a site or mailbox has already been compromised, we also handle the repair of hacked websites and the cleanup work that follows. The point is not to react to every headline, but to have a clear process that turns a KEV listing into a checked asset, a confirmed version and a documented remediation, so that the next CVE is a task on a list rather than a crisis.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.