CVE-2026-124194

CVE Enrichment

CVSS: 6.5 MEDIUM
CISA KEV: Not listed

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Nov-2026 02:20
Last Modified: 11-Nov-2026 04:29
CWE: CWE-356

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:N /
                            A:N

CNA Products / Version Status

Microsoft · Microsoft 365 Apps for Enterprise Source: CNA · [email protected]
Default status: unknown

16.0.1 ≤ version < https://aka.ms/OfficeSecurityReleases — affected (custom)

Platforms: 32-bit Systems, x64-based Systems
Microsoft · Microsoft Office LTSC 2021 Source: CNA · [email protected]
Default status: unknown

16.0.1 ≤ version < 16.0.14334.21048 — affected (custom)

Platforms: 32-bit Systems, x64-based Systems
Microsoft · Microsoft Office LTSC 2024 Source: CNA · [email protected]
Default status: unknown

16.0.0 ≤ version < 16.0.17932.21140 — affected (custom)

Platforms: 32-bit Systems, x64-based Systems

Affected Products / Versions

microsoft / 365_apps Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
microsoft / 365_apps Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
microsoft / office_2021 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*
microsoft / office_2021 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*
microsoft / office_2024 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
microsoft / office_2024 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*

References

Last enrichment sync: 11-Nov-2026 05:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

The zero-day, tracked as CVE-2026-124194, has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place. Microsoft Says Outlook Zero-Day Was Exploited as It Patches 1,094 Flaws
CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability Microsoft’s November 2026 Patch Tuesday Fixes 1,235 Flaws, Including Exploited Outlook Zero-Day
The exploited zero-day flaw, CVE-2026-124194, is an Outlook spoofing vulnerability. Microsoft patches 1,094 vulnerabilities in November 2026 update

CVE (1)

People (3)

MITRE ATT&CK (1)

Vendors (1)

Products (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.