# Outlook: apply the correction for an exploited spoofing flaw Canonical: https://www.oktsec.com/radar/microsoft-outlook-cve-2026-124194 Publisher: Oktsec Language: en Published: 2026-11-12T19:04:31Z Updated: 2026-11-12T19:04:31Z Record reviewed: 2026-11-12T19:04:31Z Latest evidence check: 2026-11-12T19:04:31Z Disclosed: 2026-11-10 CISA lists CVE-2026-124194 as exploited. Microsoft identifies an Outlook spoofing flaw requiring user interaction and publishes corrections by Office edition and update channel. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA added this exact CVE to KEV on November 10. Microsoft provides corrections; the CVSS vector requires user interaction. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Microsoft - Products: Outlook - CVEs: CVE-2026-124194 - Vendor severity: CVSS 3.1 6.5 ## Technical overview Microsoft describes CVE-2026-124194 as an Outlook weakness that can let an unauthorized attacker perform spoofing over a network. Its CVSS vector requires user interaction. The record does not describe remote code execution. CISA added the CVE to KEV on November 10. This confirms known exploitation but does not establish when attacks began or whether an individual organization was affected. Microsoft lists affected Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 installations. The November 10 security release provides different builds for Current, Monthly Enterprise and Semi-Annual Enterprise channels. LTSC corrections are 14334.21048 for 2021 and 17932.21140 for 2024. Use the release table for the deployed channel rather than applying one build number to every installation. Oktsec recommends verifying installed builds after updating and assessing suspicious messages and related authentication activity separately. Applying the patch does not establish that earlier activity was harmless. ## Recommended response Apply the November 10 Office security update for each affected edition and channel. Verify the client build and investigate suspicious messages or access using your incident response process. Relevant to: Teams managing Outlook installations in Microsoft 365 Apps for Enterprise and Office LTSC 2021 or 2024. ## CVE attribution - CVE-2026-124194: Microsoft — Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024; CVSS 3.1: 6.5. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124194.json) ## Affected systems and fixes ### Microsoft 365 Apps for Enterprise Affected: Affected Outlook installations on 32 bit and x64 systems; corrections differ by deployed channel. Fixed release / action: November 10 security build for the installed channel; Current Channel 2610: 20527.20196. Consult the Microsoft release table for enterprise channels. ### Microsoft Office LTSC 2021 Affected: 16.0.1 up to but not including 16.0.14334.21048; 32 bit and x64 systems. Fixed release / action: 16.0.14334.21048 ### Microsoft Office LTSC 2024 Affected: 16.0.0 up to but not including 16.0.17932.21140; 32 bit and x64 systems. Fixed release / action: 16.0.17932.21140 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-12T19:05:11.083Z ### [CVE-2026-124194](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194) - Added: 2026-11-10 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-24 - Federal forensic triage: No Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-12T19:05:11.696Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-124194](https://api.first.org/data/v1/epss?cve=CVE-2026-124194): 1.62% probability of observed exploitation in the next 30 days; percentile 76.42%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-12T19:05:11.696Z. ## Response checklist 1. **Identify Office editions and channels** — Inventory the affected Microsoft 365 Apps for Enterprise and LTSC installations. Record the update channel and client build before selecting a correction. 2. **Use the matching security build** — Apply the November 10 security release or a later release containing it. LTSC 2021 requires build 14334.21048; LTSC 2024 requires 17932.21140. For Microsoft 365 Apps, match the deployed channel to Microsoft’s release table. 3. **Confirm the client is updated** — Oktsec recommends completing required application restarts and verifying the build on each client, including offline devices when they reconnect. 4. **Assess suspicious activity separately** — Oktsec recommends preserving suspicious messages and reviewing related authentication activity through your incident response process. KEV confirms exploitation of the vulnerability, not compromise of every installation. ## Relevance to AI environments Include managed workstations and shared mail processing environments; an Office update on one endpoint does not verify the others. ## Sources - [Microsoft CNA: Outlook scope and interaction requirement](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124194.json) — Microsoft; Vendor notice; checked 2026-11-12T19:04:31Z - [Microsoft: November 10 Office security builds](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates) — Microsoft; Vendor notice; checked 2026-11-12T19:04:31Z - [CISA KEV: CVE-2026-124194](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-12T19:04:31Z ## Editorial record - 2026-11-12T19:04:31Z: Added verified affected versions, corrections and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/microsoft-outlook-cve-2026-124194) · [Build a response plan](https://www.oktsec.com/radar/microsoft-outlook-cve-2026-124194#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=microsoft-outlook-cve-2026-124194&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=microsoft-outlook-cve-2026-124194&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.