Exploited Outlook Spoofing Bug CVE-2026-124194 Sends Credentials to an Attacker's Server, and Qualys Prints Two Totals

An unauthenticated attacker who persuades a user to open a crafted message file in an affected version of Microsoft Outlook can make the client connect to an attacker-controlled network location. Microsoft's November 10 update fixes the flaw, CVE-2026-124194, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a November 24 due date.

It is the only vulnerability in the release that Microsoft marked as exploited in the wild, according to the Qualys review of the release.

What an attacker needs

Qualys describes the bug as an Outlook spoofing vulnerability. The attacker has to get a user to open the file; nothing in the description suggests the message fires on arrival, and the Qualys page does not mention the preview pane either way.

The page says opening the file "may cause Outlook to connect to an attacker-controlled network location" without showing the usual external-content warning. A successful attack may disclose authentication information that could be used to impersonate the user.

The page lists no CVSS score, no affected build numbers and no vector label, only "an affected version of Microsoft Outlook". CISA's entry is the only dated evidence of exploitation in the sources reviewed here. Who is exploiting it, and against whom, is unknown.

Item	Value	Source
Patch released	November 10, 2026	Qualys
Added to KEV	November 10, 2026	CISA
Federal due date	November 24, 2026	CISA
Microsoft exploited flaws in release	1	Qualys

Two totals for one release

The Qualys introduction says Microsoft addressed "1235" vulnerabilities. Its product summary table lists 1094. The page does not reconcile them, so a reader quoting either should say which part of the page it came from. Microsoft is credited with 63 critical vulnerabilities on the same page.

The exploited Outlook flaw is a small item in a very large release. Qualys counts 63 critical entries, and each one competes for the same patching window. Teams that triage by volume can lose it, and the KEV due date is the cleaner signal: two weeks from the release date.

What the KEV entry adds

CISA's catalog is the only source in this report that dates the exploitation, and it lists the entry against Microsoft Office (Outlook) with the November 10 date added and the November 24 due date. The Qualys page repeats that CISA has added the flaw and urges users to patch by November 24. Neither says whether attacks are targeted or broad.

The Qualys page describes the attacker as unauthenticated and the user as the one who opens the file, so the exposure is a mail-handling problem as well as a patching one. Neither source names the file type involved, so which attachments a mail gateway should quarantine is a question for Microsoft's advisory.

What to do

Install the November Microsoft 365 Apps or Office LTSC update on every machine running Outlook, then confirm the build rather than trusting a deployment tool's green light.

The same catalog added a Barracuda ESG chain on the same date. Microsoft's own advisory page was not fetched for this report, so the affected-build list is still missing. Chrome's exploited flaw from the same week is covered in the Chrome 157 zero-day report.