Microsoft Patches Exploited Outlook Zero-Day CVE-2026-124194

• •CVE-2026-124194 is a spoofing vulnerability in Outlook with active exploitation confirmed.
• •The flaw allows attackers to impersonate users and potentially disclose sensitive information.
• •Microsoft has released a patch as part of its November 2026 Patch Tuesday updates.

On November 10, 2026, Microsoft released a patch addressing 1,094 vulnerabilities, including a zero-day in Outlook tracked as CVE-2026-124194. This spoofing flaw allows attackers to exploit Outlook's failure to warn users before executing potentially dangerous actions. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. An attacker can send a malicious file that, when opened, connects Outlook to an attacker-controlled network, potentially disclosing sensitive authentication information. Microsoft rated the flaw as moderate with a CVSS score of 6.5 and noted that it was not publicly disclosed prior to the patch. The vulnerability is, as indicated by its addition to CISA's Known Exploited Vulnerabilities (KEV) list on the same day as the patch release.