WASHINGTON, D.C. — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting a previously unknown security vulnerability in Microsoft Outlook that could expose users’ authentication information.
The vulnerability, identified as CVE-2026-124194, allows attackers to bypass certain security warnings within the popular email application, potentially exposing sensitive authentication data.
According to a Microsoft security advisory, an attacker can exploit the vulnerability by sending a specially crafted message file and convincing a recipient to open it in Outlook.
Once opened, the application may automatically connect to a network location controlled by the attacker without displaying its usual security warning about external content.
The flaw could allow attackers to access authentication information that would ordinarily be protected by Outlook’s security measures.
‼️ CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability Details: https://t.co/9hqn7XHeqI The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability, CVE-2026-124194, that can expose user authentication data. According to Microsoft’s security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook. The application may then connect to an attacker-controlled network location without showing its usual warning about external content. Microsoft released security updates for an actively exploited Outlook network-spoofing flaw (CVSS 6.5) that allows unauthenticated attackers to spoof networks. #CybersecurityNews
— Cyber Security News (@The_Cyber_News) November 12, 2026
Microsoft has released security updates to address the vulnerability, which has been assigned a severity score of 6.5 out of 10 under the Common Vulnerability Scoring System.
The company classifies the issue as a network-spoofing vulnerability that can be exploited by an attacker without first authenticating to the targeted system.
A zero-day vulnerability refers to a security flaw that has been discovered or exploited before an effective fix becomes available.
CISA’s confirmation of active exploitation indicates the vulnerability is being used in real-world attacks rather than existing solely as a theoretical security risk.
The agency’s findings underscore the importance of applying Microsoft’s latest security updates to vulnerable Outlook installations.
Users and organizations running affected versions of Outlook are encouraged to install the available security updates and exercise caution when opening unexpected or suspicious message files.
The information provided did not specify how many users or organizations have been affected by the attacks.
