Outlook Web App counts map a front end, not desktop Outlook installations

The actively exploited Outlook vulnerability CVE-2026-124194 affects desktop Office clients. ZoomEye can measure internet-visible Outlook Web App pages, but that is a separate surface. Keeping the two inventories apart prevents a misleading remediation claim.

Method

On 2026-11-13 at 18:40 UTC, I queried ZoomEye with sub_type=all, page 1, and pagesize=1.

These counts describe pages that contain the checked text. They do not represent 120,903 or 151,046 vulnerable tenants. The pages may be hosted by Microsoft, by service providers, or by organizations running their own mail infrastructure. Text can also appear in help pages and references.

The client-side risk

Microsoft describes CVE-2026-124194 as a missing warning about an unsafe action in Outlook. The CVSS 3.1 score is 6.5, with network access, no privileges, and user interaction required. The affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft's fixed builds include 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.

CISA added the CVE to its KEV catalog on November 10, 2026. Public reporting associated with the flaw says a crafted message can cause Outlook to send authentication material over the network. That explanation is useful for hunting, but the exact outcome depends on client configuration, network restrictions, and NTLM policy.

What ZoomEye can add

Use the Outlook Web App queries to find an organization's externally visible mail front ends and to check whether a branded web interface appears in an unexpected location. Confirm ownership before acting on a match.

Use endpoint inventory for the vulnerable client. Verify the Office build through the deployment tool and include locally installed, persistent VDI, and offline systems. Review mail-flow and proxy telemetry for clients that contact unusual WebDAV or SMB destinations after a message is opened.

Restrict outbound SMB and WebDAV where possible. Reduce NTLM use and enforce stronger authentication and signing controls. These measures limit the value of authentication material if the client makes a connection.

The public web count and the endpoint patch count answer different questions. A large Outlook Web App population does not show that desktop Outlook is unpatched. A patched web front end does not cover a workstation running an old Click-to-Run build. Keep both records with their own owners and verification dates.

References

• Microsoft Security Update Guide: CVE-2026-124194
• CISA alert: CISA adds six known exploited vulnerabilities to catalog
• ZoomEye