Skip to content
securitytabs

Updated

Microsoft patches Outlook spoofing flaw already used in attacks

Microsoft has fixed a flaw in Outlook that attackers were already exploiting, and US authorities have ordered federal agencies to apply the fix. Organizations that use Outlook through Microsoft 365 should make sure the November updates are installed.

Outlook spoofing flaw exploited before Microsoft fix
Outlook spoofing flaw exploited before Microsoft fix

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Microsoft fixed a Microsoft Outlook spoofing vulnerability, CVE-2026-124194, in its November 2026 Patch Tuesday updates. Microsoft says it is aware of active exploitation, which makes it a zero-day (a flaw exploited before a fix existed). The affected product is listed as Microsoft 365 Apps for Enterprise. [1][2]

The SANS Internet Storm Center says the bug may hide the risk of a file being opened, in the style of a Mark of the Web problem, and that Microsoft does not rate it critical. [3]

Exploitation and ratings

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on 2026-11-10, with a federal due date of 2026-11-24. CISA lists known ransomware use as unknown. The CVSS score is 6.5. The cited sources do not say who is exploiting the flaw or how many targets are affected. [2]

Context

The fix was one of a very large November release. Counts differ by source: SecurityWeek counts 1,094 flaws patched and the SANS Internet Storm Center 1,260. [1][3]

Timeline

  1. The SANS Internet Storm Center described the bug as one that may hide the risk of an opened file. [3]

  2. CISA added the flaw to its Known Exploited Vulnerabilities catalogue. [2]

  3. Microsoft released a fix for the Outlook spoofing flaw and said it is aware of active exploitation. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Microsoft has patched an Outlook flaw it says is being exploited, and CISA lists it as exploited. [1][2]

What to do

  1. Make sure Microsoft 365 apps are updated with Microsoft's November 2026 fixes, or ask your IT provider to confirm. [1]
  2. Ask your provider whether the fix for CVE-2026-124194 has been applied. [2]

Mid-size company

A small IT or security team

What to know

CISA set a federal remediation due date of 2026-11-24 for this flaw, which Microsoft says is under active exploitation. [2][1]

What to do

  1. Deploy Microsoft's November Patch Tuesday updates to Microsoft 365 Apps for Enterprise installations. [1][2]
  2. Check your asset inventory to confirm all Outlook installations are covered by the update. [2]

Large enterprise

A security operations team

What to know

The flaw is rated 6.5 on CVSS yet is exploited, and no indicators or attacker details have been published in the cited sources. [2][1]

What to do

  1. Prioritize the November Microsoft 365 Apps updates and meet CISA's 2026-11-24 date if you follow KEV deadlines. [2]
  2. Watch Microsoft's advisory for CVE-2026-124194 for further details on exploitation. [1]

Sources

  1. [1]SecurityWeek · Nov 10, 19:19 UTC
    Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoftcontext
  2. [2]CISA Advisories · Nov 10, 12:00 UTC
    CISA Adds Six Known Exploited Vulnerabilities to Catalogcontext
  3. [3]SANS Internet Storm Center StormCast · Nov 11, 02:00 UTC
    SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)context