CISA Adds Outlook Flaw CVE-2026-124194 to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194, a Microsoft Office Outlook flaw described as a "missing user interaction for potentially unsafe action" vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026. CISA confirms the bug is being actively exploited, and under Binding Operational Directive (BOD) 26-04 — the successor to BOD 22-01 — federal civilian agencies must apply the fix by November 24, 2026, a 14-day remediation window. The flaw lets an attacker-crafted Outlook item skip the warning that normally pops up before Outlook connects to an outside server, quietly leaking a user's Windows authentication material. Here is what the CVE actually does, why CISA cares, and what both IT admins and everyday Outlook users should do about it.

What CISA announced on November 10

In an alert titled "CISA Adds Six Known Exploited Vulnerabilities to Catalog," CISA said it added six new entries to the KEV catalog based on evidence of active exploitation. One of the six is CVE-2026-124194, affecting Microsoft Office Outlook. The KEV catalog is CISA's running list of vulnerabilities that attackers are confirmed to be using right now, not just theoretical risks — entries get added only "based on evidence of active exploitation," which is a higher bar than a routine Patch Tuesday fix. For background on how Microsoft's monthly release cadence relates to events like this, see this site's explainer on what Patch Tuesday actually is, and the rundown of this month's broader Patch Tuesday release, of which this Outlook fix was part.

CISA's own KEV catalog entry for CVE-2026-124194 lists the vendor as Microsoft, the product as "Office," and gives it the formal name "Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability." The entry's short description states plainly: "Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network."

What "missing user interaction for potentially unsafe action" actually means

The name sounds abstract, but it describes a specific and fairly narrow failure in Outlook's own user interface — not a flaw where a user has to click a phishing link or enable macros. According to Microsoft's own advisory data for this CVE, the underlying weakness is catalogued as CWE-356, "Product UI Does Not Warn User of Unsafe Actions." In plain terms: Outlook is supposed to show a warning before it silently reaches out to an external server to fetch something referenced inside a message (think of the standard "this message contains content from an external source that your organization has blocked" style prompt). In the vulnerable versions, that warning simply doesn't fire under certain conditions.

Microsoft's advisory explains the practical attack chain this way: an unauthenticated attacker sends a specially crafted message file and convinces a user to open it in an affected version of Outlook. Opening the file causes Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, which can disclose the user's NTLMv2 authentication hash. An attacker who captures that hash can potentially use it to authenticate as the victim elsewhere on the network — a classic NTLM-relay-style credential theft, dressed up as a "spoofing" CVE because CVSS categorizes the impact that way.

So the "missing user interaction" in the name refers to the missing warning dialog, not a zero-click exploit — the CVSS vector Microsoft published (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) still marks user interaction as required (UI:R) to open the file in the first place. But once that one click happens, there is no second confirmation step the way there normally would be: no pop-up warning the user could use to back out before Outlook silently phones home and exposes credential material. Microsoft also confirmed the Preview Pane is not an attack vector here, so a message merely sitting in the inbox, or glanced at in the preview pane, does not trigger it — the user does have to actively open the item.

Why KEV inclusion matters, even if the CVSS score looks "moderate"

A 6.5 CVSS score alone wouldn't normally generate headlines — it's well below "critical." What changes the calculus is that CISA has independent evidence this specific flaw is being exploited in the wild, right now, rather than sitting as a theoretical risk. That's the entire purpose of the KEV catalog: it is reserved for bugs with confirmed exploitation, and its presence is itself the signal that patching should jump the queue. A vulnerability can have a modest CVSS score and still be a live, working attack tool for whoever is using it, which is exactly the kind of gap the KEV list exists to flag — similar in spirit to how CVSS scores don't always tell the whole urgency story on their own.

Microsoft's own advisory data corroborates the active-exploitation picture: it lists "Exploited: Yes" and tags the vulnerability's "latest software release" status as "Exploitation Detected," while noting it was not publicly disclosed before Microsoft shipped a fix — meaning attackers were apparently using it before researchers or Microsoft talked about it publicly, a quieter and arguably more concerning pattern than a flaw that leaks after public disclosure.

The remediation deadline, and who it technically applies to

CISA's KEV catalog entry sets a due date of November 24, 2026 — fourteen days after the November 10 addition date — for compliance with BOD 26-04, CISA's directive on "Prioritizing Security Updates Based on Risk." That directive's requirement to patch (or mitigate, or stop using the product if no fix is available) by the listed due date is legally binding only on U.S. federal civilian executive branch (FCEB) agencies. It is not a law that applies to private companies, small businesses, or home users. CISA's required action language for this entry also tells agencies to follow BOD 26-04 guidance for cloud services, and to evaluate each asset's internet exposure as part of compliance.

That said, the 14-day federal deadline is a useful proxy for urgency everyone else should borrow. CISA explicitly frames KEV additions as applicable more broadly: "although BOD 22-01 (and its successor, BOD 26-04) only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of catalog vulnerabilities as part of their vulnerability management practice." In other words, if an attacker is already using this bug against someone, the fact that your organization isn't a federal agency doesn't make you a less attractive target — it just means nobody is going to fine you for waiting.

Are home and consumer Outlook users at risk too?

Yes, with a caveat about who typically gets targeted first. The binding 14-day deadline is a federal-agency compliance mechanism, not a consumer warning — but the underlying vulnerability lives in the Outlook client software itself, and Microsoft's advisory doesn't limit the affected population to enterprise deployments. Any user running an unpatched, vulnerable build of Outlook who opens a maliciously crafted message is exposed to the same credential-disclosure mechanism, whether they work for a federal agency, a small business, or nobody at all. In practice, attackers chasing NTLM-hash theft tend to prioritize targets where a stolen hash unlocks something valuable — a corporate or government network — which is why federal agencies face the hard deadline. Consumers and small-business users should still patch as soon as an update is available rather than treating this as someone else's problem, since the exploit mechanic itself doesn't check who you work for.

What Outlook users and IT admins should actually do

• Apply Microsoft's November 2026 security updates for Outlook/Office through normal update channels (Microsoft Update, WSUS, Microsoft 365 Apps update channel, or your patch management tooling) rather than waiting for a scheduled maintenance window.
• Federal agencies should treat November 24, 2026 as the hard compliance date under BOD 26-04 and confirm patch status across every exposed Outlook/Office asset before then, including assessing internet-facing exposure as the directive requires.
• Everyone else — businesses and individuals — should patch on the same timeline voluntarily. CISA's own guidance encourages non-federal organizations to use KEV due dates as a benchmark for prioritization even though the directive doesn't bind them.
• Be cautious opening unexpected message attachments or items from unfamiliar senders in the meantime, since the flaw depends on a user opening a crafted file — the Preview Pane alone does not trigger it, per Microsoft.
• Watch for follow-on credential abuse: because the flaw can disclose NTLMv2 hashes, organizations that suspect exposure may also want to review authentication logs for unusual logins, not just confirm the patch installed.

The other five vulnerabilities CISA added the same day

CVE-2026-124194 was one of six entries CISA added to the KEV catalog in the same November 10 batch. The other five span a Chromium browser engine bug, networking and communications gear, and an email security appliance — a reminder that KEV additions regularly cut across very different product categories in a single day. They are summarized below for context; none of them involve Outlook or Office.

Notably, the two Barracuda Networks entries — the OS command injection flaw and the Email Security Gateway authentication bypass — carry a tighter November 13, 2026 remediation deadline, just three days out, suggesting CISA assessed those as higher urgency than the four-entry group (including the Outlook flaw) given the standard 14-day window. Anyone running Barracuda ESG or Cisco BroadWorks infrastructure should treat those two as the most time-pressured items in this batch, separate from the Outlook patching work discussed above.

How this fits the pattern of recent KEV additions

This is not CISA's first action against a widely used piece of Microsoft software this cycle — organizations tracking November's broader Microsoft patch release will recognize Outlook as one of several Microsoft products patched that month. It's also a useful illustration of a recurring theme: not every KEV-listed bug is a headline-grabbing "critical" score. Outlook's entry here sits at a middling 6.5, a reminder that for KEV purposes, what matters is confirmed real-world exploitation, not the raw CVSS number.

Frequently asked questions

See the FAQ section below for quick answers on patch timing, who the deadline applies to, and what attackers can actually do with this flaw.

What's next

Microsoft has already published its security update for this vulnerability as part of its November 2026 release; the practical next step for any organization is confirming that update has actually been deployed across Outlook and Office installations, not just scheduled. Federal agencies have until November 24, 2026, under BOD 26-04, and CISA's recommendation is that non-federal organizations treat the same date as their own internal target. Expect Microsoft to continue publishing incremental guidance if additional exploitation details emerge, and expect CISA's KEV catalog to keep growing — this was the sixth addition announced that single day across five different vendors, underscoring how routine active-exploitation findings have become across widely deployed software.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage