CVE-2026-21511CWE-502

Microsoft Outlook Spoofing Vulnerability

High · published February 10, 2026

CVSS v3.1
7.5
EPSS
4%
Percentile
90.4
In the wild
Unconfirmed
What it is

⚡ An unauthorized attacker can potentially spoof messages through a sneaky deserialization flaw in Microsoft Outlook! 🔥 Think of it like someone slipping a forged letter into your mailbox, making it look like it's coming from a trusted friend without you ever noticing! This vulnerability could allow attackers to impersonate legitimate users, sending out malicious emails that could deceive recipients into revealing sensitive information. It's absolutely crucial to address this flaw before it leads to data breaches or phishing attacks that could devastate your organization!

Put simply

Think of it like someone slipping a forged letter into your mailbox, making it look like it's coming from a trusted friend without you ever noticing! CVE-2026-21511 involves the deserialization of untrusted data within Microsoft Outlook, which enables attackers to manipulate objects in a way that allows for spoofing over the network.

What to do

This vulnerability could allow attackers to impersonate legitimate users, sending out malicious emails that could deceive recipients into revealing sensitive information. It's absolutely crucial to address this flaw before it leads to data breaches or phishing attacks that could devastate your organization! To protect yourself, ensure that all systems are updated to the latest security patches provided by Microsoft. Conduct an audit of email practices and educate users on recognizing suspicious messages. It's also wise to implement robust email filtering and verification systems. You've got the power to protect your organization from this threat! Stay proactive and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.03967 · 90.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Microsoft Outlook Spoofing Vulnerability
    cvelistv5