Microsoft says an Outlook spoofing flaw is already exploited

Microsoft says CVE-2026-124194, a spoofing flaw in Outlook, is already exploited. The company rates it moderate and scores it 6.5. It is not publicly disclosed.

Microsoft marks exploitation as detected. The Security Update Guide lists the flaw as exploited and sets the exploitability assessment to Exploitation Detected. Public disclosure is marked no. The CVSS temporal metrics still list exploit-code maturity as unproven, which means Microsoft is not pointing to public exploit code. The same page lists an official fix and confirmed report confidence. The base score is 6.5. The temporal score is 5.7.

The weakness is CWE-356. Microsoft describes it as a product interface that does not warn a user of an unsafe action. The assigning authority is Microsoft. The guide published the entry on November 10, 2026, as revision 1.0.

A user has to open a crafted file. Microsoft says an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and that user action.

Microsoft says the disclosed secret is the user's NTLMv2 hash, which an attacker could use to authenticate as that user. The CVSS vector is network, low complexity, no privileges required, user interaction required, scope unchanged, high confidentiality impact, and no impact on integrity or availability.

The preview pane is not an attack vector. Microsoft says the preview pane is not a way to trigger the flaw. The interaction it describes is opening a malicious Office file, not merely viewing a message list.

Office LTSC 2021 and 2024 are on the affected list. The November guide lists Office LTSC 2021 and Office LTSC 2024, in both 32-bit and 64-bit editions, among the affected products, plus two further products it does not name in the summary row. The vulnerability page's update table did not load article or build numbers, so this report does not name a Knowledge Base article.

Microsoft's remediation metric says an official fix is available. The acknowledgements name a researcher listed as nono, and Benoit Sevens, for coordinated disclosure. That credit is not a description of the detected exploitation.