CVE-2026-124194
Microsoft Outlook Spoofing Vulnerability
CVE-2026-124194 is a medium vulnerability (CVSS 6.5) in Microsoft Office, published November 10, 2026. CISA lists it as known to be exploited, since November 10, 2026. EUVD reports exploitation since November 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 3.1, CVE List
- Exploit chance
- 1.62%EPSS, 76th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
- Discussion
- 0.7 SteadyBuzz score, 9 people today
Description
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Discussion
Service degradation on Microsoft 365news.ycombinator.com ·
Never be afraid to ask questionsblog.talosintelligence.com ·
Microsoft patches actively exploited Outlook zero-dayreddit.com ·
November Patch Tuesday boasts over 1,000 bugs but only one zero-day so fartheregister.com ·
Patch Tuesday - November 2026rapid7.com ·
Microsoft Fixes Nearly 1,100 Security Vulnerabilitieskrebsonsecurity.com ·
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoftsecurityweek.com ·
Post on Blueskybsky.app ·
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | AmesianX/CVE-2026-124194-poc | 2026-11-11 |
| PoC in GitHub | Ghost-Bx1/cve-2026-124194-outlook-ntlm-hash-leak | 2026-11-11 |
| PoC in GitHub | aminaljabre77-collab/outlook-ntlm-leak-investigation | 2026-11-14 |
What each source reports
CVE List Score used
Microsoft Outlook Spoofing Vulnerability
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2026-124194- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C - Weakness
- CWE-356
- Updated
- 2026-11-10
EUVDEUVD-2026-122310
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Record
EUVD-2026-122310- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-69hg-ppjj-gg27
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an...
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Record
GHSA-69hg-ppjj-gg27- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-356
- Updated
- 2026-11-10
CISA KEVNo score
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2026-124194- Weakness
- CWE-356
- Updated
- 2026-11-10
NVD
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2026-124194- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-356
- Updated
- 2026-11-11
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits | PoC in GitHub | |
| exploits | PoC in GitHub | |
| exploits, facts | PoC in GitHub | |
| published | EUVD | |
| products, references | NVD | |
| published | EUVD | |
| references, severity | CVE List, NVD | |
| aliases, references | EUVD, GitHub Advisories | |
| exploitation | EUVD | |
| exploitation, facts, kev, products | CISA KEV | |
| cwes, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.