CVE-2026-124194

Medium (6.5)⚠ Active exploitationPoC

Patch nowActive exploitation confirmed by CISA on Nov 10, 2026 · US federal deadline Nov 24, 2026

Vendor advisory· msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

Severity6.5Medium · CVSS 3.1

Exploitation probability1.62 %higher than 76% of CVEs · score from Nov 11, 2026

Active exploitationYesconfirmed by CISA on Nov 10, 2026

Public exploitAvailableProof of concept on GitHub (unverified)

News and reports on Orbitaley

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Timeline

Built from our own data: NVD, CISA KEV and other exploitation catalogues, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

Nov 10, 2026Added to the CISA KEV catalogue: exploitation confirmed, federal deadline Nov 24, 2026
Nov 10, 2026Previdian lists it as exploited (public report)
Nov 10, 2026First mention in specialised media (CISA); 7 outlets have covered it since
Nov 10, 2026CVE record published in NVD
Nov 10, 2026Alert: Microsoft fixes 200 vulnerabilities, including an Outlook flaw CISA confirms is being exploited
Nov 11, 2026First public exploit

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Exploitation seen by other catalogues

Besides CISA's KEV, other catalogues of exploited vulnerabilities list this CVE. The evidence is not all alike: an attempt recorded by a honeypot is not the same as a confirmed compromise.

Previdian · successful exploitation · public report · since Nov 10, 2026

Collected through Vulnerability-Lookup (CIRCL)

Media coverage

Specialised security media that have cited this CVE:

Minuto da Segurança · Outlook: falha explorada expõe autenticação corporativa e exige correção urgente (Nov 11, 2026)
SecNews.gr · Microsoft Patch Tuesday Νοεμβρίου 2026: Πάνω από 1.200 ευπάθειες (Nov 11, 2026)
El Hacker · Microsoft confirma hackeo de Outlook para robar hashes de Windows (Nov 11, 2026)
Bitlifemedia · Microsoft corrige una vulnerabilidad de Outlook que los ciberdelincuentes ya están explotando (Nov 11, 2026)
SecNews.gr · CVE-2026-124194: Ενεργή εκμετάλλευση στο Outlook εκθέτει NTLMv2 hash (Nov 10, 2026)
SecurityWeek · Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (Nov 10, 2026)
Tenable · Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194) (Nov 10, 2026)
CISA · CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1203 Exploitation for Client Executionexecution85 %

El vector AV:N/PR:N/UI:R exige interacción del usuario, por lo que es T1203; la descripción solo menciona spoofing sin un impacto ATT&CK concreto, así que no se asignan impactos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Application Isolation and Sandboxing Exploit Protection Update Software

Affected technologies (3)

Microsoft — 365 Apps Microsoft — Office 2021 Microsoft — Office 2024

NVD record

NVD status: Analyzed
Published: Nov 10, 2026
Last modified: Nov 11, 2026
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-356
Remediation due date: Nov 24, 2026
Known ransomware use: Unknown

References

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
Government advisorycisa.gov/known-exploited-vulnerabilities-catalog

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-124194",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-124194",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-11-09T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft 365 Apps for Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1",
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC 2021",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1",
              "lessThan": "16.0.14334.21048",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC 2024",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.0.17932.21140",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2026-11-10T19:20:48.180",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-356"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network."
    }
  ],
  "lastModified": "2026-11-11T05:19:35.990",
  "cisaActionDue": "2026-11-24",
  "cisaExploitAdd": "2026-11-10",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "1D518075-3362-4D15-93B1-0E6C61518D16"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "1059BEC6-C30B-4F0F-A878-5267A21CBD85"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "8887D177-26A3-4008-89B6-50A9E9830F13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability"
}