WhatCyber / CISA KEV catalog / CVE-2026-124194
CVE-2026-124194: Microsoft Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Actively exploited (CISA KEV) MEDIUM severity
Description
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Key facts
- CVSS v3
- 6.5 (MEDIUM)
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Published
- 2026-11-10
- Last modified
- 2026-11-11
- NVD status
- Analyzed
- Added to CISA KEV
- 2026-11-10
- CISA due date
- 2026-11-24
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194 ; https://nvd.nist.gov/vuln/detail/CVE-2026-124194
Weaknesses (CWE)
- CWE-356
Affected products
- microsoft 365_apps
- microsoft office_2021
- microsoft office_2024
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194