{"id":"CVE-2026-124194","kind":"vulnerability","aliases":["CVE-2026-124194"],"related":[],"title":"Microsoft Outlook: missing warning on unsafe actions allows network spoofing","description":"Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.","summary":"Microsoft Outlook's user interface does not warn users about unsafe actions. An unauthorized attacker over the network can use this to perform spoofing.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-365","other","outlook","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:48+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","triaged_at":"2026-11-10T19:56:14+00:00","updated_at":"2026-11-10T19:56:14+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:56:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Outlook: missing warning on unsafe actions allows network spoofing","impact":"low","summary":"Microsoft Outlook's user interface does not warn users about unsafe actions. An unauthorized attacker over the network can use this to perform spoofing.","audience":"businesses","category":"other","nicknames":[],"who_cares":["outlook","microsoft-365","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker spoofs content to mislead Outlook users","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-124194 for affected builds, patch and exploitation details.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":4596,"output_tokens":344,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124194':13A,16A '-2026':12A,15A '-365':18B 'action':7A,33B,54C 'allow':8A,59C 'attack':36B,62C 'cve':11A,14A 'interfac':26B 'microsoft':1A,17B,22B,56C 'miss':3A 'network':9A,39B,68C 'offic':57C 'outlook':2A,20B,23B,58C 'perform':44B,64C 'product':46C 'spoof':10A,45B,65C 'ui':47C 'unauthor':35B,61C 'unsaf':6A,32B,53C 'use':41B 'user':25B,30B,51C 'warn':4A,29B,50C 'window':21B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","microsoft365","other","outlook","windows"],"campaign_type":null,"search_a":"'-124194':13A,16A '-2026':12A,15A 'action':7A 'allow':8A 'cve':11A,14A 'microsoft':1A 'miss':3A 'network':9A 'outlook':2A 'spoof':10A 'unsaf':6A 'warn':4A","search_b":"'-365':18B 'action':33B 'attack':36B 'interfac':26B 'microsoft':17B,22B 'network':39B 'outlook':20B,23B 'perform':44B 'spoof':45B 'unauthor':35B 'unsaf':32B 'use':41B 'user':25B,30B 'warn':29B 'window':21B","search_c":"'action':54C 'allow':59C 'attack':62C 'microsoft':56C 'network':68C 'offic':57C 'outlook':58C 'perform':64C 'product':46C 'spoof':65C 'ui':47C 'unauthor':61C 'unsaf':53C 'user':51C 'warn':50C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:02:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124194","severity":null,"published_at":"2026-11-10T19:20:48+00:00","modified_at":"2026-11-10T19:20:48+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","fetched_at":"2026-11-10T19:25:13+00:00","note":null}],"documents":[{"id":117344,"url":"https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review","title":"Zero Day Initiative: The November 2026 Security Update Review","kind":"blog","source":"blog","publisher":null,"text":"The November 2026 Security Update Review\n\nThe penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release. Adobe Patches for November 2026 For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK. Here’s this month’s overview table: Adobe Patches for November 2026 Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority APSB26-191 Adobe Connect 24 Critical 10.0 No 2 APSB26-189 Adobe Experience Manager 14 Critical 9.9 No 2 APSB26-102 Adobe Audition 11 High 8.7 No 3 APSB26-100 Adobe After Effects 17 High 8.6 No 3 APSB26-190 Adobe Dimension 1 High 8.2 No 3 APSB26-181 Adobe Photoshop 13 High 7.8 No 3 APSB26-101 Adobe Premiere 11 High 7.8 No 3 APSB26-103 Adobe Media Encoder 6 High 7.8 No 3 APSB26-184 Content Credentials SDK 13 Medium 6.5 No 3 TOTAL 9 bulletins 110 Obviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It’s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager . It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope. Besides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release. Microsoft Patches for November 2026 Well, at least it’s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it’s huge but less than the 1,400 or so released last month. That’s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We’ll see how close I came to matching Microsoft’s “ Cohorts ” list. Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software. Let’s begin by covering some of the more severe and interesting patches released this month. - CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv","published_at":"2026-11-10T19:02:41+00:00","relation":"mentions","confidence":null,"note":null},{"id":117297,"url":"https://x.com/BleepinComputer/status/2120232895520645304","title":"@BleepinComputer: ‼️‼️ Microsoft’s November 2026 Patch Tuesday fixes a massive 1,235 vulnerabiliti","kind":"post","source":"x","publisher":null,"text":"‼️‼️ Microsoft’s November 2026 Patch Tuesday fixes a massive 1,235 vulnerabilities, including 66 rated Critical and an actively exploited Microsoft Outlook zero-day.\n\nThe Outlook flaw (CVE-2026-124194) can be exploited using malicious message files that trick Windows into\n\nlikes 132 reposts 37","published_at":"2026-11-10T19:11:28+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}