What happened
CWE-356 missing user interaction for potentially unsafe action. CISA added CVE-2026-124194 to KEV on 2026-11-10 with confirmed in-the-wild exploitation.
Why it matters
Not AI-specific. Outlook is a common delivery channel for prompt-injection-laden email and AI-assistant integrations; a spoofing flaw that arrives in the mail stream is relevant to agentic email tools.
Attack vector
An unauthorized attacker can perform spoofing over the network, exploiting the missing user-interaction gate for a potentially unsafe action.
Affected systems
Microsoft Office Outlook
Mitigation
Apply the Microsoft update per MSRC CVE-2026-124194; CISA federal due date 2026-11-24.