CVE-2026-124194 in Outlook Is Being Exploited: Prioritize Mitigation Before the CISA Deadline

CISA confirms that CVE-2026-124194 in Microsoft Office Outlook is being exploited in the wild. Prioritize assessing affected assets and applying Microsoft's mitigation guidance; vulnerability information is available in the Microsoft guidance for CVE-2026-124194.

Overview and technical details

Microsoft Office Outlook is an email and calendar application in the Microsoft Office suite. The vulnerability concerns the lack of a user warning when performing a potentially unsafe action, which may allow an unauthorized attacker to carry out network spoofing.

Affected systems

The identified product is Microsoft Office Outlook. The source information does not specify affected version branches, so consult Microsoft's guidance to determine the scope across managed assets.

Exploitation status

CISA confirms that the vulnerability is being exploited in the wild and has added CVE-2026-124194 to KEV. This is the exploitation status confirmed in the source information; it does not establish that a public PoC exists or that the vulnerability is a zero-day.

Remediation and mitigation

1. Assess the Internet exposure of each asset running Outlook to prioritize risk.
2. Apply mitigation measures according to Microsoft's guidance. The source information does not provide a patched version or a specific workaround.
3. Follow BOD 26-04 guidance on risk-based prioritization of security updates and CISA's Forensics Triage Requirements. For cloud services, follow the corresponding BOD 26-04 guidance.
4. If no mitigation is available, discontinue use of the product. The CISA deadline given in the source information is 2026-11-24; apply it within the scope of BOD 26-04.

References

• Microsoft Security Response Center: CVE-2026-124194