Microsoft Outlook Spoofing Vulnerability
CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook (rated Moderate, CVSS 6.5). Microsoft reports that it is being exploited.
Exploited1 version
Facts
- Microsoft id
CVE-2026-124194- Status
- Exploited
- Products
- Microsoft Office Outlook
- Severity
- Moderate
- Impact
- Spoofing
- CVSS
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- Yes
- Release
- 2026-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-356: Product UI does not Warn User of Unsafe Actions
- MSRC revision
- 1.0
- Status pages
- Outlook status
- First captured by us
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-11-10:
Information published.
Microsoft says
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Mentioning the same Microsoft ids
Other changes for Outlook
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Information Disclosure Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
Last updated