WASHINGTON, D.C. — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting a previously unknown security vulnerability in Microsoft Outlook that could expose users' authentication information.
The warning comes as Microsoft 365 services experience widespread outages on Thursday, Nov. 12, affecting users around the world.
Problems have been reported with Outlook, Microsoft Teams and other Microsoft 365 services, with users experiencing difficulties accessing email accounts, sending and receiving messages, and connecting to workplace applications.
Outage-tracking website Downdetector recorded nearly 130,000 reports of Outlook problems shortly after noon CST. Thousands of additional reports involved Microsoft Teams and other Microsoft 365 services. The figures represent user-submitted outage reports rather than a confirmed number of affected users.
In an update posted on X, Microsoft acknowledged the service disruptions. The company said it was investigating infrastructure experiencing elevated load across multiple regions, which appeared to be contributing to connectivity problems.
The widespread outages have raised questions about whether they could be connected to the recently disclosed Outlook security vulnerability. However, no connection between the two incidents has been confirmed, and Microsoft has not identified the vulnerability as a cause of the service disruptions.
The vulnerability, identified as CVE-2026-124194, allows attackers to bypass certain security warnings within the popular email application, potentially exposing sensitive authentication data.
According to a Microsoft security advisory, an attacker can exploit the vulnerability by sending a specially crafted message file and convincing a recipient to open it in Outlook.
Once opened, the application may automatically connect to a network location controlled by the attacker without displaying its usual security warning about external content.
The flaw could allow attackers to access authentication information that would ordinarily be protected by Outlook’s security measures.
‼️ CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability Details: https://t.co/9hqn7XHeqI The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability, CVE-2026-124194, that can expose user authentication data. According to Microsoft’s security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook. The application may then connect to an attacker-controlled network location without showing its usual warning about external content. Microsoft released security updates for an actively exploited Outlook network-spoofing flaw (CVSS 6.5) that allows unauthenticated attackers to spoof networks. #CybersecurityNews
— Cyber Security News (@The_Cyber_News) November 12, 2026
Microsoft has released security updates to address the vulnerability, which has been assigned a severity score of 6.5 out of 10 under the Common Vulnerability Scoring System.
The company classifies the issue as a network-spoofing vulnerability that can be exploited by an attacker without first authenticating to the targeted system.
A zero-day vulnerability refers to a security flaw that has been discovered or exploited before an effective fix becomes available.
CISA’s confirmation of active exploitation indicates the vulnerability is being used in real-world attacks rather than existing solely as a theoretical security risk.
The agency’s findings underscore the importance of applying Microsoft’s latest security updates to vulnerable Outlook installations.
Users and organizations running affected versions of Outlook are encouraged to install the available security updates and exercise caution when opening unexpected or suspicious message files.
The information provided did not specify how many users or organizations have been affected by the attacks.
More to come
