{"id":"CVE-2026-21511","state":"PUBLISHED","title":"Microsoft Outlook Spoofing Vulnerability","description":"Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.","publishedAt":"2026-02-10T17:51:35.908Z","updatedAt":"2026-08-19T16:26:06.084Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft 365 Apps for Enterprise","Microsoft Microsoft Office 2019","Microsoft Microsoft Office LTSC 2021","Microsoft Microsoft Office LTSC 2024","Microsoft Microsoft Office LTSC for Mac 2021","Microsoft Microsoft Office LTSC for Mac 2024","Microsoft Microsoft SharePoint Enterprise Server 2016","Microsoft Microsoft SharePoint Server 2019","Microsoft Microsoft SharePoint Server Subscription Edition","Microsoft Microsoft Word 2016"],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.106.26020821","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.106.26020821","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.5539.1002","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.10417.20097","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server Subscription Edition","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.19127.20518","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Word 2016","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.5539.1002","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21511"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/21xxx/CVE-2026-21511.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-21511","state":"PUBLISHED","datePublished":"2026-02-10T17:51:35.908Z","dateUpdated":"2026-08-19T16:26:06.084Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2025-12-30T18:10:54.845Z"},"containers":{"cna":{"title":"Microsoft Outlook Spoofing Vulnerability","descriptions":[{"lang":"en-US","value":"Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network."}],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.106.26020821","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.106.26020821","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.5539.1002","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.10417.20097","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server Subscription Edition","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.19127.20518","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Word 2016","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.5539.1002","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21511","name":"Microsoft Outlook Spoofing Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-08-19T16:26:06.084Z"},"datePublic":"2026-02-10T16:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2016:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.5539.1002"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.10417.20097"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.106.26020821"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.19127.20518"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.106.26020821"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:word_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.0.5539.1002"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-11T15:44:45.355051Z","id":"CVE-2026-21511","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-11T15:45:41.731Z"}}]}}}