Microsoft Outlook: spoofing vulnerability (CVE-2026-124194) exploited in the wild, fix released
Published 11/11/2026 18:16 · Updated 11/11/2026 20:44 (revision 2)
Timeline
4 events over 1 d 19 h
- 10/11/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 10/11/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 17 h
- 11/11/2026 18:16Published on WatchtowerPro CISO+2 h
- 11/11/2026 20:44UpdatedCorrected: the fixed builds per product (the Microsoft 365 Apps build shown before was…
In short
A spoofing vulnerability in Microsoft Outlook (Microsoft 365 Apps, Office LTSC 2021 and 2024). If a user opens a crafted message file, Outlook connects to an attacker's server without the usual external-content warning and discloses the user's NTLMv2 hash, which the attacker can use to sign in as that user. The Preview Pane is not an attack vector. Microsoft reports exploitation and CISA lists the flaw as exploited. Microsoft released fixes on 10/11/2026: install the Office update.
How bad is it
Medium, but already used in attacks. An attacker who persuades a user to open a crafted message file can capture that user's password hash and use it to sign in as them.
Being exploited - on CISA's known-exploited list since 10/11/2026.
Severity score
CVSS 3.1 from NVD, from microsoft.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
Type: information disclosure.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): from 16.0.1 to before the fixed build of each update channel (https://aka.ms/OfficeSecurityReleases).
- Office LTSC 2024 (32-bit and 64-bit): from 16.0.0 to before 16.0.17932.21140.
- Office LTSC 2021 (32-bit and 64-bit): from 16.0.1 to before 16.0.14334.21048.
Fixed in
- Office LTSC 2024: 16.0.17932.21140
- Office LTSC 2021: 16.0.14334.21048
- Microsoft 365 Apps for Enterprise: the fixed build of each update channel, listed at https://aka.ms/OfficeSecurityReleases
What to do now
- Install the Office updates released on 10/11/2026 first.
- Office LTSC 2024: update to 16.0.17932.21140 or later.
- Office LTSC 2021: update to 16.0.14334.21048 or later.
- Microsoft 365 Apps: update to the fixed build for your update channel, listed at https://aka.ms/OfficeSecurityReleases.
- Microsoft names no interim measure for this flaw, so installing the update is the only vendor fix.
- If you suspect exploitation, treat the affected user's credentials as exposed and reset them.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 6 sources with their dates and every revision. And technology matching: which of your systems run Microsoft Office Outlook, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Microsoft Office - Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability Vendor · CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability Vendor · Known exploited (VulnCheck KEV): Microsoft Office - Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability Research