SB20261110346 - Spoofing attack in Microsoft Outlook

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110346

SB20261110346 - Spoofing attack in Microsoft Outlook

Published: November 10, 2026

Security Bulletin ID SB20261110346
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Product UI does not warn user of unsafe actions (CVE-ID: CVE-2026-124194) Exploited

CWE-ID: CWE-356 - Product UI does not Warn User of Unsafe Actions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain a user's NTLMv2 authentication hash.

The vulnerability exists due to a failure to warn users of unsafe actions in Microsoft Office Outlook when opening a specially crafted message file. A remote attacker can convince a user to open the file, causing Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, to obtain the user's NTLMv2 authentication hash.

The Preview Pane is not an exploitation vector.

Note, the vulnerability is being exploited in the wild.


Remediation

Install update from vendor's website.

References