CVE Details
CVE-2026-124194
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Published: 2026-11-10
CVSS: 6.5 MEDIUM
Product: Microsoft Office
Due Date: 2026-11-24
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
No GitHub PoC data.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
No EPSS data.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2026-124194 |
| cveMetadata > | assignerOrgId | f38d906d-7342-40ea-92c1-6c4a2c6478c8 |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | microsoft |
| cveMetadata > | dateReserved | 2026-11-06T22:09:21.493Z |
| cveMetadata > | datePublished | 2026-11-10T18:22:22.493Z |
| cveMetadata > | dateUpdated | 2026-11-10T19:42:38.152Z |
| containers > | cna > title | Microsoft Outlook Spoofing Vulnerability |
| containers > | cna > datePublic | 2026-11-10T16:00:00.000Z |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > operator | OR |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > negate | False |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria | cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding | 16.0.1 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding | 16.0.14334.21048 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria | cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding | 16.0.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding | 16.0.17932.21140 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria | cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding | 16.0.1 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding | https://aka.ms/OfficeSecurityReleases |
| containers > | cna > affected > 0 > vendor | Microsoft |
| containers > | cna > affected > 0 > product | Microsoft 365 Apps for Enterprise |
| containers > | cna > affected > 0 > platforms > 0 | 32-bit Systems |
| containers > | cna > affected > 0 > platforms > 1 | x64-based Systems |
| containers > | cna > affected > 0 > versions > 0 > version | 16.0.1 |
| containers > | cna > affected > 0 > versions > 0 > lessThan | https://aka.ms/OfficeSecurityReleases |
| containers > | cna > affected > 0 > versions > 0 > versionType | custom |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 1 > vendor | Microsoft |
| containers > | cna > affected > 1 > product | Microsoft Office LTSC 2021 |
| containers > | cna > affected > 1 > platforms > 0 | 32-bit Systems |
| containers > | cna > affected > 1 > platforms > 1 | x64-based Systems |
| containers > | cna > affected > 1 > versions > 0 > version | 16.0.1 |
| containers > | cna > affected > 1 > versions > 0 > lessThan | 16.0.14334.21048 |
| containers > | cna > affected > 1 > versions > 0 > versionType | custom |
| containers > | cna > affected > 1 > versions > 0 > status | affected |
| containers > | cna > affected > 2 > vendor | Microsoft |
| containers > | cna > affected > 2 > product | Microsoft Office LTSC 2024 |
| containers > | cna > affected > 2 > platforms > 0 | 32-bit Systems |
| containers > | cna > affected > 2 > platforms > 1 | x64-based Systems |
| containers > | cna > affected > 2 > versions > 0 > version | 16.0.0 |
| containers > | cna > affected > 2 > versions > 0 > lessThan | 16.0.17932.21140 |
| containers > | cna > affected > 2 > versions > 0 > versionType | custom |
| containers > | cna > affected > 2 > versions > 0 > status | affected |
| containers > | cna > descriptions > 0 > value | Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
| containers > | cna > descriptions > 0 > lang | en-US |
| containers > | cna > problemTypes > 0 > descriptions > 0 > description | CWE-356: Product UI does not Warn User of Unsafe Actions |
| containers > | cna > problemTypes > 0 > descriptions > 0 > lang | en-US |
| containers > | cna > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | cna > problemTypes > 0 > descriptions > 0 > cweId | CWE-356 |
| containers > | cna > providerMetadata > orgId | f38d906d-7342-40ea-92c1-6c4a2c6478c8 |
| containers > | cna > providerMetadata > shortName | microsoft |
| containers > | cna > providerMetadata > dateUpdated | 2026-11-10T19:42:38.152Z |
| containers > | cna > references > 0 > name | Microsoft Outlook Spoofing Vulnerability |
| containers > | cna > references > 0 > tags > 0 | vendor-advisory |
| containers > | cna > references > 0 > tags > 1 | patch |
| containers > | cna > references > 0 > url | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194 |
| containers > | cna > metrics > 0 > format | CVSS |
| containers > | cna > metrics > 0 > scenarios > 0 > lang | en-US |
| containers > | cna > metrics > 0 > scenarios > 0 > value | GENERAL |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | MEDIUM |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 6.5 |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C |