CISA KEV lists Outlook spoofing flaw CVE-2026-124194
Original title: CISA KEV: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability — Microsoft Office (CVE-2026-124194)
An unauthorized attacker can spoof over the network without the expected user interaction; deadline is November 24.
CISA added CVE-2026-124194, a Microsoft Office Outlook missing-user-interaction flaw, to the Known Exploited Vulnerabilities catalog. It lets an unauthorized attacker perform spoofing over a network. Required action follows vendor instructions and BOD 26-04, with a due date of November 24. Known ransomware use is unknown, and no fixed version is stated.
Unconfirmed: Known ransomware campaign use is unknown, and no patch version is given.
- The flaw is in Microsoft Office Outlook.
- Impact described is network spoofing, not code execution.
- Due date is November 24, 2026.
- Ransomware campaign use is unknown.
Impact: Network spoofing without required user interaction
| Product | Affected |
|---|---|
| Microsoft Office Outlook | — |
- 1.Apply vendor mitigations under BOD 26-04 by November 24, 2026.
- 2.Stop using the product if mitigations are unavailable.
- CVEs
- CVE-2026-124194
- Vendors
- Microsoft
- Products
- Office Outlook
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
1 min read at cisa.govMicrosoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.