What happened
Microsoft Outlook is affected by CVE-2026-124194, a vulnerability that Microsoft says has been actively exploited. The flaw was exploited before it was publicly known, and it is listed in CISA’s Known Exploited Vulnerabilities catalogue. The vendor assigns it medium severity, with a CVSS score of 6.5. The CVSS vector indicates that exploitation is possible over a network, requires no privileges and requires user interaction. The stated impact is high to confidentiality; no impact to integrity or availability is indicated. The weakness is classified as CWE-356. A fix is available.
Who is affected
Affected deployments include Microsoft 365 Apps for Enterprise on 32-bit and x64-based systems, versions 16.0.1 to before the applicable Office security release identified at <code>https://aka.ms/OfficeSecurityReleases</code>. Microsoft Office LTSC 2021 on 32-bit and x64-based systems is affected from version 16.0.1 to before 16.0.14334.21048. Microsoft Office LTSC 2024 on 32-bit and x64-based systems is affected from version 16.0.0 to before 16.0.17932.21140.
Recommended actions
- Apply the available Microsoft fix to affected Outlook deployments, using the vendor’s update information to identify the applicable fixed release.
- Identify deployments running the affected Microsoft 365 Apps for Enterprise or Office LTSC versions and prioritise them for remediation, given confirmed active exploitation.
- Reinforce caution around Outlook content that requires user interaction, as the CVSS vector indicates that interaction is necessary for exploitation.
