The agency describes the Microsoft Outlook vulnerability as a missing user interaction for a potentially unsafe action. Microsoft patched the flaw after attackers exploited it to steal account authentication data.
CISA added CVE-2026-124194 to its catalog of vulnerabilities known to be exploited, citing evidence that attackers were using the Outlook flaw. Microsoft patched it in its November 2026 security updates, BleepingComputer said.
CISA describes the flaw as a missing user interaction for a potentially unsafe action in Microsoft Office Outlook. Microsoft calls it a spoofing vulnerability, meaning it can help an attacker impersonate a user.
Microsoft said an attacker could persuade someone to open a specially crafted message file in an affected version of Outlook. The file could then cause Outlook to connect to an attacker-controlled network location without its usual external-content warning, potentially exposing authentication information that could be used to impersonate the user. An attack requires network connectivity and user interaction.
BleepingComputer said attackers had used the flaw to steal NTLM account hashes, data associated with account authentication.
CISA encourages organizations to prioritize fixing vulnerabilities in its exploited-flaws catalog. Its directive on vulnerability management applies only to Federal Civilian Executive Branch agencies.
The Japanese retailer says it blocked unauthorized access on 6 November and will contact affected customers by email or post.
2 min
Governor Kathy Hochul launched the center at Binghamton University as the state opened a registration portal for large developers. Both prepare for RAISE Act requirements beginning 1 January 2027.
3 min
Davidson says he has joined OpenAI to work on the future of travel. Odessia’s travel-agent tool has shut down.
1 min
Update ·
Revised from the day's reports.
Update ·
The update adds affected products, Microsoft’s classification of the flaw and the number of vulnerabilities fixed in its November release.
