Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

What is CVE-2026-124194?

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Who is affected by CVE-2026-124194?

Affects anyone using Microsoft 365 or Office to compose, store, or send email, documents, or spreadsheets. In a small practice, that's typically where client communications, engagement letters, and case notes live — credential compromise here means an attacker reads everything that platform stores.

What should I do about CVE-2026-124194?

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Request a free review.

CISA due date

CISA's listed due date: November 24, 2026.

Federal civilian agencies work under CISA's Binding Operational Directive 26-04, which replaced BOD 22-01 on June 10, 2026. It sets the deadline for each affected system by:

• How exposed that system is to the internet
• Whether the attack can be automated
• How much control it gives an attacker

Its table gives catalogued vulnerabilities 3 or 14 days.

None of this binds a private business, but treat the date as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).

Other exploited Microsoft Office entries

More CISA KEV entries for Microsoft Office. Same product line, same actively-exploited status.

• CVE-2009-0238: Microsoft Office Remote Code Execution
• CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
• CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability
• CVE-2009-0556: Microsoft Office PowerPoint Code Injection Vulnerability
• CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability
• CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability
• CVE-2023-21715: Microsoft Office Publisher Security Feature Bypass Vulnerability
• CVE-2009-0563: Microsoft Office Buffer Overflow Vulnerability

Browse more

• All Microsoft KEV entries
• All SMB-relevant KEV entries

Source

This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.