CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability CVE-2026-124194 that can expose user authentication data.

According to Microsoft’s security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook. The application may then connect to an attacker-controlled network location without showing its usual warning about external content.

That connection can disclose the victim’s NTLMv2 hash, authentication data that an attacker could use to impersonate the user. Microsoft classifies the issue as spoofing rather than remote code execution. Its assessment identifies a high impact on confidentiality, but no direct impact on data integrity or service availability.

Microsoft released security updates for an actively exploited Outlook network-spoofing flaw (CVSS 6.5), allowing unauthenticated attackers to spoof networks.

The weakness falls under CWE-356, which covers software that fails to obtain proper user approval before a potentially unsafe action. Here, the missing warning removes a safety check before Outlook reaches an outside network location.

Active Exploitation of Outlook 0-Day Vulnerability

However, “missing user interaction” does not mean this is a zero-click attack. Microsoft explicitly states that the victim must open a malicious file. The Outlook Preview Pane is not an attack vector for this vulnerability. That detail helps defenders avoid confusing it with earlier Outlook flaws that required no user action.

Cyber Security News previously covered Russian hackers exploiting Outlook through CVE-2023-23397 and CISA’s warning about the MonikerLink vulnerability. Those reports provide background on Outlook exploitation, but their attack methods should not be treated as evidence of how this new flaw works.

Microsoft lists affected 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Fixed builds include 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Microsoft 365 administrators should use the Office security release guidance linked in the advisory to identify the correct update for their deployment.

CISA added the flaw to its KEV catalog on November 10, 2026, setting a November 24 remediation deadline and requiring organizations to apply vendor mitigations, assess internet exposure, and discontinue affected products if fixes are unavailable.

Administrators should identify affected Office installations, deploy the relevant fixes, and verify installed build numbers rather than relying only on update deployment reports. The moderate severity label should not outweigh the confirmed exploitation evidence when teams set their patching order.

Microsoft marks exploitation as detected, although the reviewed advisory does not identify attackers, victims, campaign scale, or indicators of compromise. Those gaps should remain explicit rather than being filled with details from older Outlook attacks.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability appeared first on Cyber Security News.