NewsSecurityWeek
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by MicrosoftType Vulnerability
Microsoft
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
2 sourcesCVE-2026-124194
At a glance
High
24-hour window, from the last update
ActiveConfirmed in-the-wild exploitation
Evidence-weighted, not popularity
Signal
Actively exploited in the wild — prioritise confirming exposure.
Why High
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Microsoft 365 Apps, treat it as Critical.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run Microsoft 365 Apps, Microsoft Office 2021 and Microsoft Office 2024, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 11 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-124194- 6.5 · MediumExploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality.CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Listed: attacks using it have been seen (on the catalogue since )
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorised attacker to perform spoofing over a network.
- CVE-2026-124194 is confirmed as exploited in the wild (US known-exploited catalogue)
- Authoritative catalogues report active exploitation of this vulnerability.
Products and services involved
- Microsoft 365 Apps93% match confidence · CVE-2026-124194
- Microsoft Office 202193% match confidence · CVE-2026-124194
- Microsoft Office 202493% match confidence · CVE-2026-124194
25 reports
Part of Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges ov
- Server-side Request Forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network
- Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network
- Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally
- Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network
Same event, different frames
Distinct often headline the same incident differently.
OfficialCISA Known Exploited Vulnerabilities
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action VulnerabilityPulse
Last change 26m ago · Next recheck 11 Nov 2026, 03:32 UK time
- Story10 Nov 2026, 20:33 UK time · 1h ago
Linked reporting from SecurityWeek (independent original reporting).
Read source (SecurityWeek) - Story10 Nov 2026, 21:32 UK time · 26m ago
Linked reporting from CISA (official authority).
Read source (CISA Known Exploited Vulnerabilities)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- SecurityWeekNews
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- ConfirmedSummary fact75% confidence
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorised attacker to perform spoofing over a network.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-124194
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-124194 is confirmed as exploited in the wild (US known-exploited catalogue)