MicrosoftAvailable
SC-900
CVE-2026-124194 Microsoft Office Vulnerability: Patch Guide
CVE-2026-124194 is a Microsoft Office Outlook spoofing flaw that CISA added to its Known Exploited Vulnerabilities catalog on 2026-11-10. This guide covers the risk, the deadline, and concrete checks you can run today.
Short answer: CVE-2026-124194 is a medium-severity (CVSS 6.5) Outlook flaw: the interface fails to warn users before an unsafe action, which enables network spoofing. CISA added it to the KEV catalog on 2026-11-10, with a federal due date of 2026-11-24. Check the Microsoft advisory for the fix, update Outlook, and use the commands below to find exposed machines.
What happened
Microsoft Office Outlook has a flaw that lets an unauthorized attacker spoof content over a network. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10. That listing means attackers are using it in the wild.
The NVD record describes it this way: the product UI does not warn the user of unsafe actions. The weakness type is CWE-356, "Product UI does not warn user of unsafe actions." Microsoft titles it "Missing User Interaction for Potentially Unsafe Action."
In plain terms, Outlook lets a risky action go ahead without a clear prompt. A user can be tricked because nothing tells them to stop.
Who is affected
Anyone running Microsoft Office Outlook is in scope until they confirm otherwise. The NVD entry lists no affected-versus-fixed build table, so we do not guess at version numbers. The fixed build is in Microsoft's own advisory: MSRC CVE-2026-124194.
CISA tells stakeholders to evaluate each asset's internet exposure. For most teams, that means every Windows desktop with Outlook installed, plus any shared or virtual desktops.
How serious it is
The CVSS v3.1 score is 6.5 MEDIUM, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Here is what the vector means:
Metric | Value | Meaning |
|---|---|---|
Attack vector | Network | Attacker needs no local access |
Complexity | Low | No special conditions |
Privileges | None | No account needed |
User interaction | Required | A person must act |
Confidentiality | High | Data can be exposed |
Integrity / Availability | None | No tampering or outage |
Do not let "medium" lower your guard. The KEV listing matters more than the score. Spoofing flaws that need one click are a common start for phishing and credential theft.
CISA lists known ransomware use as Unknown. Check the CISA KEV entry for updates.
What to do now
CISA's required action is to apply mitigations per vendor instructions. It must follow BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." For cloud services, follow the applicable BOD 26-04 guidance. If no mitigation exists, discontinue use of the product. The federal due date is 2026-11-24. Private teams should treat that as a sensible target too.
Open the Microsoft advisory and note the fixed build for your Office channel.
Inventory your Outlook builds with the commands below.
Update Outlook on exposed machines first: laptops, remote users, and shared desktops.
Re-run the inventory to confirm the new build.
Keep records of what you changed and when, in case you need forensic triage later.
Check your Outlook build on one machine
These commands work for Click-to-Run installs. Run them in PowerShell:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" | Select-Object VersionToReport, CDNBaseUrl
(Get-Item "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE").VersionInfo.ProductVersionCompare the output with the fixed build in the Microsoft advisory.
Find exposed machines at scale
If you use Microsoft Defender Vulnerability Management, run this in advanced hunting:
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-124194"
| project DeviceName, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel
| order by DeviceName ascIf you do not use Defender, export installed Outlook versions from your endpoint tool and compare them to the advisory.
Triage order for a mixed fleet
You rarely patch everything at once. Use this table to decide what goes first.
Situation | Priority | Action |
|---|---|---|
Outlook on a laptop used outside the office network | Highest | Update today, then confirm the build |
Shared or virtual desktop with many users | High | Update in the next maintenance window |
Executives and finance staff | High | Update early; they are common phishing targets |
Locked-down kiosk with no mail use | Lower | Update on the normal cycle |
While you wait for patches, tell staff to treat unexpected prompts, links, and attachments in Outlook with care. Ask them to report anything odd to your help desk. Training does not replace the patch, but it limits the one thing this flaw depends on: a person acting.
What learners can take from this
This flaw is a good case study in why "user interaction required" does not mean "low risk." When software skips a warning, attackers do the persuading. Practice reading a CVSS vector, spotting UI:R, and explaining why a medium score can still be urgent when it is on the KEV list. Our Cyberattack Explained guide maps these steps to attack stages. Browse more security paths in our Cybersecurity certifications.
If you want a Microsoft-focused path, the AZ-500 Azure Security Engineer Associate voucher costs $44.99 and arrives by email within 12 hours.
Sources
Questions about this topic
Does CVE-2026-124194 let attackers run code on my PC?
The NVD record describes spoofing over a network, not code execution. The CVSS vector shows high confidentiality impact and no integrity or availability impact. The main risk is that someone is misled into an unsafe action and data is exposed.
What does CWE-356 mean?
CWE-356 is the weakness type "Product UI does not warn user of unsafe actions." The software lets a risky action proceed without a clear warning, so users cannot make an informed choice.
Why does a medium CVSS score still need fast action?
CISA added the flaw to its KEV catalog on 2026-11-10, which means exploitation has been seen. A KEV listing reflects real-world use, which a base score alone cannot show. Prioritize it above many unexploited high-score bugs.
When is the CISA deadline for this vulnerability?
The federal due date is 2026-11-24. It binds US federal agencies, but other organizations can use it as a target for their own patching.
Where do I find the fixed Outlook build?
Open the Microsoft Security Response Center page for CVE-2026-124194. It holds the vendor guidance and update details for your Office edition. Compare it with the version output from the commands above.
