CVE-2026-124194
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
What is it?
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Official description from NVD.
What happened
Microsoft released its November 2026 Patch Tuesday, addressing a record 1,235 vulnerabilities including an actively exploited Microsoft Outlook zero-day (CVE-2026-124194). The patch surge includes critical RCE flaws in LDAP, Queuing services, and Windows TCP/IP. Organizations should prioritize patching Outlook and critical vulnerabilities immediately, especially for internet-facing systems.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalMicrosoft November 2026 Patch Tuesday fixes 1,235 flawsNov 10, 2026
- HighCISA adds Microsoft Outlook spoofing flaw to KEVNov 10, 2026