Microsoft Outlook Spoofing Vulnerability

CVE-2026-21511 is a spoofing vulnerability in Microsoft Office Outlook (rated Important, CVSS 7.5).

1 version

Microsoft id: CVE-2026-21511
Products: Microsoft Office Outlook
Severity: Important
Impact: Spoofing
CVSS: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation More Likely
Customer action required: Yes
Release: 2026-Feb
Assigned by: Microsoft
Weakness: CWE-502: Deserialization of Untrusted Data
MSRC revision: 1.1
Status pages: Outlook status
First captured by us: 13 Nov 2026, 14:59 UTC (from our first import of this list)
Microsoft last modified: 11 Feb 2026, 16:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Revision 1.0, 2026-02-10: Information published.
Revision 1.1, 2026-02-11: Acknowledgement added. This is an informational change only.

Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Security updates, 16:00 UTC, 11 Feb

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 14:59 UTC, 13 Nov
The text as we first saw it
Seen by us 14:59 UTC, 13 Nov · Microsoft's timestamp 16:00 UTC, 11 Feb · Microsoft's page