CISA Adds Exploited Outlook Spoofing Flaw to Its KEV List

CISA has added an exploited Microsoft Outlook spoofing vulnerability, CVE-2026-124194, to its Known Exploited Vulnerabilities catalogue. The catalogue entry is dated 10 November 2026, in version 2026.11.10, with a due date of 24 November 2026. Microsoft had already listed the same CVE as exploited in its Security Update Guide, published on 10 November 2026 at 08:00 Pacific Time (16:00 UTC, 16:00 Europe/London).

The useful facts for anyone running Outlook are narrower than a “zero-day in email” headline. Microsoft says an unauthenticated attacker could send “a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.” Opening that file “could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning.” The Preview Pane, Microsoft says, “is not an attack vector.” This is not a zero-click bug, and it is not described as stealing a user’s password in plaintext.

What the Outlook spoofing flaw actually discloses

Microsoft rates the issue moderate, with a CVSS 3.1 base score of 6.5 and the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The high confidentiality score, it says, reflects this: “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” That is a hash that could be used for authentication, not a demonstrated theft of the password itself. Exploitation, Microsoft adds, requires network connectivity and user interaction. A second FAQ, explaining the UI:R metric, says the attacker “must send a user a malicious Office file and convince them to open it.”

CISA’s short description is more compressed: the vulnerability “allows an unauthorized attacker to perform spoofing over a network.” Its required action is to apply vendor mitigations in line with Binding Operational Directive 26-04. Known ransomware campaign use is listed as Unknown, not Yes or No, and forensic triage is listed as No. Neither Microsoft nor CISA has named attackers or victims in public.

The November security updates cover three product families in Microsoft’s affected-product list: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2024, and Microsoft Office LTSC 2021. For the two LTSC editions Microsoft publishes fixed build numbers, 16.0.17932.21140 and 16.0.14334.21048 respectively. For Microsoft 365 Apps it points to the Microsoft 365 Apps security updates page rather than a single build in the advisory. Those are the products Microsoft has listed. Other Outlook or Office editions should not be assumed from this CVE page.

The 24 November date is a federal deadline, not a universal one

CISA’s due date of 24 November applies to Federal Civilian Executive Branch agencies under BOD 26-04, the directive that now governs how those agencies remediate entries in the KEV catalogue. It is a compulsory timeline for those federal systems. It is not, by itself, a legal deadline for every private company, school or household running Outlook. The reason to patch quickly is the one Microsoft has already given: exploitation has been detected, and a vendor fix is available.

That distinction matters in a week when CISA has been adding other exploited bugs to the same catalogue, including Chrome’s XML zero-day CVE-2026-125350 and IBM Aspera Faspex CVE-2026-123218. A KEV due date tells federal civilian agencies when CISA expects the work to be done. It does not rank the severity of the bug, and a CVSS score of 6.5 does not mean a patch can wait until someone else’s clock runs out.

The same care is needed when reading “spoofing” and “hash.” This follows Microsoft’s October Patch Tuesday fix for a Windows Shell zero-day already used in attacks in one respect only: Microsoft has said the vulnerability is exploited. It does not follow it in mechanism. The Outlook issue needs the user to open a file. It does not run from the Preview Pane. Treating it as a zero-click mail bug, or as proof that passwords themselves have been dumped, goes beyond what the two official sources have said.

A moderate score does not cancel an exploited patch

The tension in this advisory is between a moderate base score and an Exploitation Detected label. Those two facts sit together because user interaction is required and because the impact Microsoft has specified is disclosure of an NTLMv2 hash, not a complete takeover of the Outlook process. None of that makes the update optional for a machine that still has to open mail. An exploited bug with a documented vendor fix is urgent because it is exploited and because the patch exists, not because CISA has set 24 November for federal agencies.

Organisations outside that federal set should still treat the Microsoft update as the action that matters, then confirm the build they are actually running. Microsoft 365 Apps customers will need the current channel security update, not an assumed LTSC build number. LTSC 2024 and 2021 customers have specific fixed builds. Anyone tempted to delay until a public write-up of the message file appears should remember that Microsoft is already withholding the kind of detail that would make reproduction easier, and that this article will not fill that gap.

The next date on the federal side is 24 November. For everyone else, the next check is whether the November Outlook or Microsoft 365 Apps update is installed and whether other Chromium-class or Office-adjacent patches from this week have been handled on the same estate. The KEV row records that CISA now agrees the vulnerability is known to be exploited. The patch is still the Microsoft one.

Sources

1. Microsoft Security Response Center, “Microsoft Outlook Spoofing Vulnerability,” CVE-2026-124194, 10 November 2026. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
2. CISA, Known Exploited Vulnerabilities Catalog, CVE-2026-124194, date added 10 November 2026, due date 24 November 2026, catalogue version 2026.11.10. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Related stories

Chrome 157’s exploited XML zero-day, CVE-2026-125350, was added to the same CISA KEV catalogue on 10 November, another vendor-exploited bug whose federal due date is also 24 November.

Also relevant:

• Microsoft Fixes Windows Shell Zero-Day Already Used in Attacks
• CISA Adds IBM Aspera Faspex Flaw CVE-2026-123218 to KEV