Security September 2026 Latest record Microsoft Office Outlook Remote Code Execution Vulnerability Recorded 9 Nov 2026 at 22:24 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position.
See the latest record .
CVE Microsoft Security Response Center
Microsoft Office Outlook Remote Code Execution Vulnerability Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE CVE-2026-100208
Severity Important
CVSS base score 7.5
CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact Remote Code Execution
Exploitation detected No known exploitation (MSRC assessment)
Publicly disclosed No (MSRC assessment)
Exploitability Exploitation Less Likely
Component Microsoft Office Outlook
Weakness CWE-190: Integer Overflow or Wraparound
Issued by Microsoft
Customer action Required: follow the MSRC remediation guidance
Affected products Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions
Updates that fix it No KB listed
CISA KEV Not listed in the collected catalog
EPSS 0.5%; scored 9 Nov 2026
Public detection template No Nuclei template listed
Published 25 Sep 2026 07:00 UTC
Last revised 25 Sep 2026 07:00 UTC
Revision note Information published.
Microsoft security releases Complete at observationRead 9 Nov 2026 at 22:23 UTC
CISA KEV Complete at observationRead 9 Nov 2026 at 22:23 UTC
FIRST EPSS Complete at observationRead 9 Nov 2026 at 22:23 UTC
Public detection templates (Nuclei) Complete at observationRead 9 Nov 2026 at 22:23 UTC Coverage describes the sources at this observation. A complete read then does not establish their current position.
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
6 Nov 2026 · 17:32:22 UTC Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
6 Nov 2026 · 16:31:02 UTC
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (15)
Up to 100 recent field edits are shown; older edits may be outside retention.
9 Nov 2026 · 22:24:37 UTC
EPSS 0.5%; scored 8 Nov 2026 → 0.5%; scored 9 Nov 2026 8 Nov 2026 · 15:16:05 UTC
EPSS 0.5%; scored 7 Nov 2026 → 0.5%; scored 8 Nov 2026 7 Nov 2026 · 16:12:44 UTC
EPSS 0.5%; scored 6 Nov 2026 → 0.5%; scored 7 Nov 2026 6 Nov 2026 · 19:15:37 UTC
EPSS 0.5%; scored 5 Nov 2026 → 0.5%; scored 6 Nov 2026 6 Nov 2026 · 17:32:22 UTC
Public detection template Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed 6 Nov 2026 · 17:32:22 UTC
Source coverage: public-exploit-code Incomplete → Current 6 Nov 2026 · 17:32:22 UTC
Source coverage: first-epss Incomplete → Current 6 Nov 2026 · 17:32:22 UTC
Source coverage: msrc-cvrf Incomplete → Current 6 Nov 2026 · 16:31:02 UTC
Public detection template No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained 6 Nov 2026 · 16:31:02 UTC
Source coverage: public-exploit-code Current → Incomplete 6 Nov 2026 · 16:31:02 UTC
Source coverage: first-epss Current → Incomplete 6 Nov 2026 · 16:31:02 UTC
Source coverage: msrc-cvrf Current → Incomplete 5 Nov 2026 · 23:42:03 UTC
EPSS 0.5%; scored 4 Nov 2026 → 0.5%; scored 5 Nov 2026 5 Nov 2026 · 02:36:20 UTC
EPSS 0.5%; scored 3 Nov 2026 → 0.5%; scored 4 Nov 2026 4 Nov 2026 · 03:04:37 UTC
EPSS 0.5%; scored 2 Nov 2026 → 0.5%; scored 3 Nov 2026