CVE-2026-124194 Microsoft 365 Apps
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- CVSS
- 6.5 Medium
- EPSS
- 1.6%
- Percentile
- 76
- Published
- 2026-11-10
- Force
- 9 of 12
- Public PoC
- 2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
On CISA’s exploited list
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- Added
- 2026-11-10
- Federal patch deadline
- 2026-11-24
- Ransomware use
- not known
In the news
- Never be afraid to ask questionsCisco Talos · 2026-11-12
- Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)SANS Internet Storm Center · 2026-11-11
- Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilitiesCisco Talos · 2026-11-11
- Microsoft Fixes Nearly 1,100 Security VulnerabilitiesKrebs on Security · 2026-11-10
- CISA Adds Six Known Exploited Vulnerabilities to CatalogCISA Advisories · 2026-11-10