IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Office Outlook: Spoofing due to missing warning for unsafe actions

CVE-2026-124194Medium 6.5Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 10 Nov 2026
Deadline for US federal agencies: 24 Nov 2026

Summary

A spoofing vulnerability in Microsoft Office Outlook, the mail client of Microsoft 365 Apps and Office LTSC, allows an unauthorized attacker to spoof content over the network. The user interface does not warn users before potentially unsafe actions. According to secondary reporting, opening a crafted message file can make Outlook connect to an attacker-controlled location and leak the user's NTLMv2 hash. Microsoft and CISA report active exploitation, and CISA lists the flaw in its KEV catalog.

Affected

  • Microsoft 365 Apps for Enterprise: from 16.0.1 (fixed build not confirmed)
  • Office LTSC 2021 (32- and 64-bit): from 16.0.1 up to, but not including, 16.0.14334.21048
  • Office LTSC 2024 (32- and 64-bit): from 16.0.0 up to, but not including, 16.0.17932.21140

Fixed in

  • Security updates released on November 10, 2026 (Patch Tuesday)
  • Confirm the installed build against the MSRC Security Update Guide, as the fixed build for Microsoft 365 Apps is not confirmed in the sources.

Workaround

  • No vendor-confirmed workaround known.
  • Until patched, restrict outbound NTLM and SMB traffic to the internet at the firewall (own recommendation, not from the vendor).

Exploitation

  • Exploited in the wild. CISA added the flaw to the KEV catalog on 2026-11-10, with a federal remediation deadline of 2026-11-24.
  • Known use in ransomware campaigns: Unknown.
  • Public proof of concept: none known.

Our recommendation

  • Deploy the November 10, 2026 Office and Outlook updates to all Microsoft 365 and Office LTSC clients immediately.
  • Verify the installed build against the MSRC table.
  • Restrict outbound NTLM and SMB traffic and review NTLM usage.
  • Review Outlook and NTLM logs for unexpected outbound connections.
  • Brief users to treat unexpected message files with caution.
  • Treat as high priority despite the Medium CVSS score (6.5).

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Moderate
Impact
Spoofing – Microsoft Office Outlook
Status on Patch Tuesday
Exploited (zero-day)
Exploitability assessment
Exploitation detected
Product family
Microsoft Office

Entry in the Microsoft Security Update Guide

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:14.

Original description (NVD)

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed