A critical vulnerability in Microsoft Office Outlook, tracked as CVE-2026-124194, has been identified as being actively exploited in the wild on the same day it was publicly disclosed. The flaw, which involves a missing user interaction requirement for potentially unsafe actions, allows an unauthorized remote attacker to conduct spoofing attacks over a network.
The vulnerability was officially reserved on November 6, 2026, and received its public disclosure on November 10, 2026. Evidence of active exploitation was reported simultaneously with the disclosure, leading to its immediate inclusion in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on the same day.
Multiple authoritative sources have confirmed the rapid weaponization of this flaw. In addition to CISA, the European Union Agency for Cybersecurity (ENISA) and the commercial research firm VulnCheck both listed the vulnerability in their respective KEV catalogs on November 10. The Computer Incident Response Center Luxembourg (CIRCL) also mirrored these findings, solidifying the consensus that the vulnerability was being targeted by attackers immediately upon its public release.
Microsoft has acknowledged the issue through its security update guide, confirming the existence of the vulnerability and the reports of active exploitation. While the technical details provided by the vendor describe a spoofing risk stemming from the lack of necessary user interaction, the company has directed users to follow standard security update procedures to mitigate the threat.
CISA has mandated that federal agencies address this vulnerability by November 24, 2026, in accordance with Binding Operational Directive (BOD) 26-04. This directive requires organizations to prioritize security updates based on risk and perform necessary forensics triage. For systems where patches or mitigations cannot be applied, the agency advises stakeholders to evaluate the internet exposure of their assets and, if necessary, discontinue the use of the affected product.
The vulnerability is currently classified as high severity, though specific details regarding its use in ransomware campaigns remain unknown at this time. Security teams are urged to review their environments for signs of unauthorized network activity related to Outlook and to ensure that all Microsoft Office software is updated to the latest version as specified in the vendor’s security documentation.
While the reports from CISA, ENISA, and VulnCheck provide a consistent timeline of the exploit’s emergence, the underlying public reports of exploitation have been aggregated from various sources. As with all emerging threats, organizations should focus on the official guidance provided by Microsoft and the remedial timelines established by CISA to ensure their networks remain protected against potential spoofing attempts.
