CISA Adds Patched Outlook Zero-Day to KEV
CISA added CVE-2026-124194 to KEV, with a November 24, 2026 federal deadline. Microsoft says the Outlook flaw was exploited and fixed it in the November updates, part of a 1,094-vulnerability batch according to SecurityWeek. Apply the updates or vendor mitigations immediately.
What happened
Microsoft fixed an Outlook flaw that the company says was exploited. CISA added the vulnerability to KEV and set November 24, 2026 as the federal deadline.
Why it matters
A malicious message file can make Outlook access an attacker-controlled network location without the usual warning. This may expose NTLMv2 authentication information and allow the attacker to authenticate as the user.
What to do
Install the November 2026 updates or apply vendor-prescribed mitigations. If mitigations are unavailable, CISA directs organizations to discontinue use of the product.
For the technical team
- CVE
- CVE-2026-124194
- Affected
- Microsoft Outlook · Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
- Exploitation
- Microsoft says CVE-2026-124194 was exploited but provided no details about the observed attacks. CISA added it to KEV, with a November 24, 2026 federal deadline. The flaw was not publicly disclosed before the fix became available.
- Fix
- Microsoft fixed the vulnerability in its November 2026 updates. The sources provide no specific fixed version numbers. CISA directs users to apply vendor mitigations or discontinue the product if mitigations are unavailable.
- Vector
- A spoofing flaw caused by missing user interaction or warning before a potentially unsafe action. An unauthenticated attacker sends a specially crafted message file and convinces the victim to open it; Outlook may then access an attacker-controlled network location and disclose the user's NTLMv2 hash. The Preview Pane cannot trigger the flaw.
- More details
- Microsoft credited researchers “nono” and Benoît Sevens with the discovery; Sevens' acknowledgment mentions the use of Anthropic's Claude model. CISA lists ransomware use as unknown.
Timeline
The Outlook flaw was fixed as part of a Microsoft update covering 1,094 vulnerabilities.
CISA added CVE-2026-124194 to KEV and set a November 24, 2026 federal deadline.
Incident opened.
Sources 3 sources
- @BleepinComputer @BleepinComputer
- CVE-2026-124194: Microsoft Office (Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability) CISA KEV
- Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft SecurityWeek
