Advisory · CVE-2026-70125
Microsoft Outlook RCE needs only one bad email
A remote code execution flaw in Outlook rated HIGH at CVSS 8.8 lets an attacker run code as the user once a crafted message is opened or previewed.
- Vendor
- Microsoft
- Product
- Microsoft Outlook
- Identifier / CWE
- CVE-2026-70125
- Action timing
- Immediate
Explain it like I’m five
An email arrives that is booby-trapped. When you open it or even preview it, the trap fires and the attacker gets to run their own code on your computer, with your permissions.
- 01Crafted message
An attacker sends an Outlook message designed to trigger the vulnerability; no privileges are required on the target.
- 02User opens or previews
The flaw requires user interaction, so opening or previewing the message in Outlook is enough to reach the vulnerable code path.
- 03Remote code executes
The attacker achieves remote code execution with the privileges of the Outlook user, with high impact on confidentiality, integrity, and availability.
What happened
Microsoft published a security bulletin for a remote code execution vulnerability in Outlook, tracked as CVE-2026-70125 and rated HIGH at CVSS 8.8. The CVSS vector shows a network attack with low complexity and no privileges required, but it does require user interaction, which matches the classic pattern of a malicious email that executes when opened or previewed.
The bulletin lists as affected: Microsoft 365 Apps for Enterprise at build 16.0.1, Microsoft Office LTSC 2021 at build 16.0.1, and Microsoft Office LTSC 2024 at build 16.0.0, up to the build published in Microsoft’s Office security releases guidance. Successful exploitation runs attacker code with the privileges of the Outlook user.
What to do
- Install the latest Office security updates on all endpoints running the affected releases; treat Outlook users as high priority because exploitation only needs one message.
- Confirm the installed build is at or above the fixed build in Microsoft’s Office security releases guidance.
- For any endpoint where exploitation is suspected, isolate the machine and follow your normal incident response: check for persistence, review recent email, and rotate credentials used from that machine.
- Remind users to report unexpected emails rather than opening them, as the trigger is a single crafted message.
Management note
Outlook is the mail client most of your workforce reads every message in. An 8.8-rated RCE there is a classic initial-access path, and patch coverage on desktop Office is usually the long tail of any patching program. Close the tail.