Loading vulnerability…
Path Traversal Leading to Code Execution in Microsoft Office Outlook
CVE-2026-124228 is a path traversal vulnerability in Microsoft Office Outlook. Improper restriction of pathnames to an intended directory allows an authorized attacker to execute code over a network. The vulnerability is rated Important and was addressed in Microsoft's November 10, 2026 security updates. It was not marked as exploited at release. The vulnerable function and affected version ranges are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits code execution through a network-based attack against Microsoft Office Outlook. The execution privileges and scope of resulting system access are not specified.
If you can’t patch tonight, do this now.
No interim workaround is specified. Apply the applicable Microsoft security updates promptly.
Patch, then assume compromise.
Apply the applicable Microsoft Office Outlook security updates from the November 10, 2026 release. Consult Microsoft's Security Update Guide for affected product versions, applicable update packages, and fixed builds.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.