From PC World: Microsoft has issued an urgent warning regarding an actively exploited security flaw in Outlook. Designated as CVE-2026-124194, the vulnerability enables attackers to trick users into opening a tampered message file. When opened, Outlook may connect to a server controlled by the attacker without displaying the usual security warning. This puts the user’s authentication credentials at risk of being leaked, which could lead to potential impersonation.
Although Microsoft classifies the vulnerability as moderately severe, we recommend installing the latest security updates, as active exploitation has been confirmed. The affected products include Microsoft 365 for business, as well as Office LTSC 2021 and 2024. The user must open the malicious file themselves for the attack to succeed.
The vulnerability is one of 1,093 that Microsoft addressed in its November security updates, according to the security firm Tenable. Of these, 63 are classified as critical. The US Cybersecurity and Infrastructure Security Agency (CISA) also added the vulnerability to its list of known security flaws that are being actively exploited.
Microsoft recommends that affected users install the latest security updates, which was released on November 10th. Office can normally be updated via the program’s account settings, while business users may need to contact their IT department.
View: Full Article
