pwned.coffeeOrder ticket · today's special · 10 Nov 2026

🔥 On the fly · exploited in the wildUS federal deadline 2026-11-24Americano · 183°CmediumOrder up · fix available

Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Microsoft 365 Apps for Enterprise

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-11-10 (federal deadline 2026-11-24).

Binds US federal agencies under CISA BOD 26-04.

Do this now

Upgrade Microsoft Office LTSC 2021 to 16.0.14334.21048 and Microsoft Office LTSC 2024 to 16.0.17932.21140.

Who should check: teams running Azure / M365

Fix it

Microsoft Office LTSC 2021

Upgrade to Microsoft Office LTSC 2021 16.0.14334.21048

Microsoft Office LTSC 2024

Upgrade to Microsoft Office LTSC 2024 16.0.17932.21140

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 20:19 UTC
Fixed in: Microsoft Office LTSC 2021 16.0.14334.21048
Microsoft Office LTSC 2024 16.0.17932.21140
Identifiers: CVE-2026-124194
CVSS: 6.5
KEV deadline: 2026-11-24
Source: CISA KEV
On the menu as: Azure / M365

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Severity: medium, exploited in the wild. Patch status: patched.
Affected: Microsoft 365 Apps for Enterprise
Fixed in: Microsoft Office LTSC 2021 16.0.14334.21048, Microsoft Office LTSC 2024 16.0.17932.21140
Ids: CVE-2026-124194

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-11-10 (federal deadline 2026-11-24).

## Steps
1. This incident involves a provider (azure). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.
2. Fix by release line: Microsoft Office LTSC 2021: 16.0.x → 16.0.14334.21048. Microsoft Office LTSC 2024: 16.0.x → 16.0.17932.21140.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Microsoft Office LTSC 2021 16.0.x | fixed | 16.0.14334.21048 | — |
| Microsoft Office LTSC 2024 16.0.x | fixed | 16.0.17932.21140 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-124194") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194 https://nvd.nist.gov/vuln/detail/CVE-2026-124194 https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/
https://pwned.coffee/i/microsoft-office-outlook-missing-user-interaction-for-po-cve-2026-124194

Timeline

10 Nov 2026, 20:19 UTC
Reported by securityweek.com: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
10 Nov 2026, 19:18 UTC
Fix status: unknown → patched.
10 Nov 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-124194 added to CISA KEV on 2026-11-10, federal deadline 2026-11-24.” source
Overheard “CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation.” source
Fix by release line: Product Affected Fixed in Source
Microsoft Office LTSC 2021 16.0.1 to before 16.0.14334.21048 16.0.14334.21048 CVE record (CNA) checked 12 Nov
Microsoft Office LTSC 2024 16.0.0 to before 16.0.17932.21140 16.0.17932.21140 CVE record (CNA) checked 12 Nov
Score: CVSS 6.5 (medium). CVSS 3.1 6.5 (CNA microsoft) for CVE-2026-124194
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Microsoft Office LTSC 2021	16.0.1 to before 16.0.14334.21048	16.0.14334.21048	CVE record (CNA) checked 12 Nov
Microsoft Office LTSC 2024	16.0.0 to before 16.0.17932.21140	16.0.17932.21140	CVE record (CNA) checked 12 Nov

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone coffee