Outlook zero-day scored 6.5: medium is no free pass

CVE-2026-124194 in Microsoft Outlook is already being exploited. The score is 6.5, but email remains the main way into SMEs. Install this month's Office updates now.

Microsoft's November updates list more than a thousand vulnerabilities. Most teams start at the top, with the nines and tens. CVE-2026-124194 scores 6.5: "moderate", according to Microsoft. It is also the flaw Microsoft itself says is already being exploited. And it sits in Outlook, which stays open all day in almost every SME.

A medium score is not a free pass. On 10 November, CISA, the US cybersecurity agency, added it to the KEV catalogue: the list of vulnerabilities with confirmed active exploitation. US federal agencies have until 24 November. Belgian and European SMEs will not get a letter from Washington. They do get the same emails.

What's going on

Outlook does not warn the user about a potentially unsafe action (CWE-356). Microsoft calls the result spoofing over the network: an attacker with no login can impersonate something, or someone, you trust. In Microsoft's words, an unauthenticated attacker can send a specially crafted message file and convince a user to open it in Outlook. Opening it can cause Outlook to connect to an attacker-controlled server without the usual external-content warning. Authentication material can leak: an NTLM hash. That is not a password in readable text, but it can be enough to impersonate that user.

Microsoft says the Preview Pane is not an attack path: the file has to be opened. This is not a break-in the moment a message lands in the inbox. It is a familiar route: an email, an attachment, one click.

The fix is in the November Office updates, shipped on Patch Tuesday, Microsoft's monthly update day. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft has not shared details of the observed attacks. CISA confirms this in its KEV catalogue and an alert dated 10 November: actively exploited, ransomware use "unknown". SecurityWeek calls it a zero-day: the flaw was not public when the patch appeared, and was already being used.

Why this belongs in the boardroom

Email is still the main way into SMEs. Almost every invoice, supplier request and "quick one" from the CEO runs through Outlook. A flaw that makes that stream quieter does not belong at the bottom of the patch list because the score is "only" medium.

Under NIS2, boards must show they manage risks like this. Leaving a known, actively exploited flaw open in the company mailbox is hard to defend. Last week we made the same point about the SonicWall VPN flaw: the score was not a ten, the KEV listing was. Even a 6.5 belongs at the top once it is being used in the wild.

There is also a gap organisations like to blur: "the patch is out" is not the same as "every laptop has it". Staff on the road, a device that was offline for a week, an update channel that lags: the attacker is in no hurry. They have an inbox.

Through the attacker's eyes

At XPOSE, we think like the other side. What follows are scenarios, not a reconstruction of an attack and certainly not a how-to.

They look for what everyone postpones. In a list of more than a thousand updates, a busy IT team goes to whatever is marked red first. A 6.5 disappears in the middle. That is exactly why a medium flaw is attractive: the patch exists, the attention does not.

The missing warning is the weapon. Phishing works better when the screen stays quiet. Many staff are trained to hesitate at a pop-up about external content. If that prompt never appears, the click feels safe. The message looks as if it came from a colleague or a supplier. That is the start of business email compromise: fraud in which someone impersonates a trusted party, often to obtain a payment.

A real identity is worth more than a fake one. If Outlook leaks authentication material, the attacker does not need a lookalike address. They can try to act as the user themselves. Internally, that sender is already trusted.

The laptop that has not caught up is the target. The patch shipped on 10 November. Then the work starts: every device, every update channel, every employee who assumes Microsoft 365 updates the client by itself. The flaw sits in Outlook on the machine.

What to do today

1. Install the November Office updates now, on every machine running Outlook. Do not wait for the next maintenance evening.
2. Check that Microsoft 365 Apps actually auto-update. Look at the update channel, at devices that have been offline for a while, and whether "Update Now" has really been run.
3. Do not assume "we are in the cloud, so we are covered". The mailbox may be in Microsoft 365; the vulnerable client is on the laptop.
4. Warn staff briefly and clearly: do not open unexpected message files or attachments, even from a familiar name. The usual external-content warning may not appear here.
5. Ask your MSP in writing: when were the November Office updates rolled out, which update channel are we on, and which devices are still behind.
6. Have someone check what of your environment is publicly visible, and whether the patch policy on paper also holds on the laptops.

Final thoughts

A medium score measures technical severity. It does not measure how quickly someone scrolls past it, or whether the attack is already under way. CVE-2026-124194 lives in Outlook, is already being exploited, and the patch is out. What remains is whether it is also on every laptop.

XPOSE Security tests your environment the way real APT attackers would: from the mailbox that is still the front door to the laptop that had not yet taken the update. Better we find it than they do. Get in touch and strengthen your security posture structurally with our CISO as a Service.