Microsoft has issued an urgent warning about an actively exploited security flaw in Outlook. Designated CVE-2026-124194, the vulnerability allows attackers to trick users into opening a crafted message file. When opened, Outlook can connect to a server controlled by the attacker without displaying the usual security warning. This puts the user’s authentication credentials at risk of being leaked, which could lead to potential phishing.
Although Microsoft classifies the vulnerability as moderately severe, we recommend installing the latest security updates as an active exploitation has been confirmed. Affected products include Microsoft 365 for enterprise, as well as Office LTSC 2021 and 2024. The user must open the malicious file themselves for the attack to be successful.
