Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft — Office
- Added to KEV catalog
- 10 November 2026
- Federal remediation due date
- 24 November 2026
- Weakness classification (CWE)
- CWE-356
AI Breakdown
What it is
Microsoft Office Outlook contains a vulnerability where it fails to require user confirmation before performing potentially unsafe actions. This flaw allows an unauthorized attacker to carry out network-based spoofing without needing victim interaction.
Why it matters
CISA has added this flaw to its Known Exploited Vulnerabilities catalog because attackers are actively exploiting it in the wild. Although specific ransomware campaign use is currently unknown, network spoofing can lead to severe unauthorized access and identity deception.
Recommended action
Apply vendor mitigations and patches immediately in line with Microsoft instructions and CISA BOD 26-04 guidance. Organizations should assess internet exposure across all assets, review forensics triage requirements, and discontinue using the product if mitigations cannot be applied.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194 ; https://nvd.nist.gov/vuln/detail/CVE-2026-124194
More Microsoft Vulnerabilities
Microsoft Windows Command Injection Vulnerability
Microsoft SharePoint Code Injection Vulnerability
Microsoft Windows Link Following Vulnerability
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services