Microsoft Outlook spoofing vulnerability allows unauthorised spoofing over a network (CVE-2026-124194)

What happened

Microsoft describes CVE-2026-124194 as a spoofing vulnerability in Microsoft Office Outlook. According to the CVE record, the product UI does not warn the user of unsafe actions, which allows an unauthorised attacker to perform spoofing over a network. The CVSS 3.1 vector rates it medium with a base score of 6.5: the attack is reachable from the network, requires no privileges and has low attack complexity, but requires user interaction. Confidentiality impact is high; integrity and availability are not affected.

CISA KEV, ENISA EUVD and Microsoft's own advisory all list this vulnerability as exploited. ENISA EUVD dates exploitation from 2026-11-10; CISA's KEV entry was added on 2026-11-10 and gives a required-action due date of 2026-11-24.

Who is affected

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024. Microsoft 365 Apps for Enterprise is affected from 16.0.1 to before the November 2026 security release. Microsoft Office LTSC 2021 is affected from 16.0.1 to before 16.0.14334.21048. Microsoft Office LTSC 2024 is affected from 16.0.0 to before 16.0.17932.21140.

What to do now

1. Apply the fixed build for your channel. Microsoft 365 Apps for Enterprise: install the November 2026 Office security release. Microsoft Office LTSC 2021: update to build 16.0.14334.21048. Microsoft Office LTSC 2024: update to build 16.0.17932.21140.
2. Treat this as actively exploited. CISA's required action has a due date of 2026-11-24 and references BOD 26-04 prioritisation, internet exposure assessment and forensics triage requirements. If the update cannot be applied, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable.
3. No vendor workaround is published. Keep affected Outlook clients on trusted networks and monitor user reports of suspicious messages until the update is applied.

Beyond the patch

Because this is an actively exploited spoofing flaw, the lasting risk is user trust in a message Outlook failed to flag. Patch first; then make sure you can detect and respond to follow-on activity. Managed Detection & Response (MDR) and an Incident Response Retainer are the services to have ready when a spoofed message leads a user to act.