CVE-2026-124194

MediumCVSS 6.5/10Known exploited (CISA KEV)Last modified Nov 11, 2026

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-356

Affected software

VendorProductVersions
MicrosoftMicrosoft 365 Apps for Enterprise>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
MicrosoftMicrosoft Office LTSC 2021>= 16.0.1, < 16.0.14334.21048
MicrosoftMicrosoft Office LTSC 2024>= 16.0.0, < 16.0.17932.21140

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
Added to CISA KEV
Nov 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-12424.3The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions CVE-2026-124217.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and includiCVE-2026-1242106.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-1242247.0Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locCVE-2026-1242257.8Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.CVE-2026-1242268.8Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.CVE-2026-1242277.5Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1242288.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to CVE-2026-1242296.6Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.CVE-2026-124237.5A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semCVE-2026-1242336.5Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-124247.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4
CVE-2026-124194: Medium severity, CVSS 6.5 | Vulnix