CVE-2026-70125

Executive Summary

CVE-2026-70125 is a remote code execution vulnerability in Microsoft Outlook, rated CVSS 8.8 (High). The NVD description consists solely of "Microsoft Outlook Remote Code Execution Vulnerability," so the precise component, file format, or code path involved is not publicly documented in the supplied intelligence. Exploitation requires user interaction (UI:R) while all other metrics are maximally severe — network vector, low complexity, no privileges, and high impact to confidentiality, integrity, and availability — consistent with an email-borne client-side code execution flaw such as a malicious message body, attachment, or rendered content that triggers code execution in the Outlook process context.

Technical Analysis

The NVD description for CVE-2026-70125 is limited to the class-level statement "Microsoft Outlook Remote Code Execution Vulnerability." No CNA title, no affected version list, no CWE mapping, no vendor fix reference, and no root-cause narrative were provided. Consequently, the following analysis is constrained to what the CVSS vector and product context support; no function names, parsing routines, file formats, or internal modules are asserted, because none appear verbatim in the source data.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that requires no authentication and no prior privileges, but does require a victim to perform some action (UI:R). The scope is unchanged (S:U), meaning the vulnerable component and the impacted component are assessed as the same security authority — typical for a client application where code executes within the Outlook process under the logged-in user's token. All three impact metrics are High, indicating total loss of confidentiality, integrity, and availability within that scope.

Remote code execution in a mail client generally falls into one of a small number of structural classes: (1) memory corruption in a parser handling attacker-supplied message content or attachments, (2) unsafe deserialization or object instantiation from message payloads, (3) injection through a rendered content handler (HTML/script or embedded object), or (4) abuse of a privileged COM/OLE or protocol handler reachable from message content. The supplied data does not allow discrimination between these classes. The UI:R metric is the strongest structural signal available: it indicates that the trigger is embedded in content the user must open, preview, or otherwise interact with, and that no zero-interaction delivery vector is assessed.

The S:U metric also bounds the blast radius in CVSS terms: exploitation yields code execution as the Outlook user, not as a separate, more privileged security authority. Escalation to SYSTEM or domain-wide control would require a subsequent privilege-escalation step outside the scope of this CVE as scored. Patch confidence is 2/4: a fix is claimed by a single source (NVD) and has not been independently corroborated by a vendor advisory, KB article, or version diff in the supplied data. Absent a confirmed patch, defenders should treat the flaw as unmitigated for planning purposes. No Nuclei template, public PoC, or exploit code was identified.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE, and the NVD description contains no function names, parameters, file paths, or endpoints. The attack chain below is therefore described strictly at the vulnerability-class level; no implementation specifics are asserted.

1. Reconnaissance / target identification. The attacker identifies organizations using Microsoft Outlook as their mail client — information obtainable from MX/DNS records, OWA login pages, or public job postings and technology fingerprints. There is no pre-authentication network service to scan: this is a client-side flaw, so targeting is user- and mailbox-centric rather than host-service-centric.

2. Trigger delivery. Because the vector is AV:N with UI:R, the attacker delivers the trigger over the network in content the victim must interact with — canonically email. Outlook supports a wide range of message and attachment formats, but the supplied data does not identify which format or content type is affected, so no specific delivery container is claimed. At the class level, the attacker sends a message or attachment that the victim opens, previews, or otherwise activates.

3. Triggering the flaw. Per the CVSS profile (AC:L, no privileges, UI required), the flaw is reached with low attacker effort once interaction occurs — no authentication or chained preconditions are assessed. The vulnerability class is RCE in the Outlook client, meaning that processing of the attacker-supplied content results in attacker-influenced code execution within the Outlook process. Without root-cause data, the specific mechanism (memory corruption, unsafe object handling, or injected content rendering) cannot be determined and is not asserted here.

4. Post-exploitation impact. Execution occurs in the security context of the Outlook user (S:U). With C:H/I:H/A:H, the attacker is positioned to read mailbox and local data, modify or destroy files the user can access, and disrupt availability of the client and its data. Outlook frequently holds cached credentials and authenticated sessions to Exchange/Microsoft 365; that positioning — combined with typical enterprise single sign-on — makes onward lateral movement through email, cloud storage, and internal shares the primary business risk. Any escalation to administrative control requires an additional, separate vulnerability.

Impact Assessment

CVSS 8.8 places this in the High severity band, driven by the combination of network reachability and total impact within scope. Subscore analysis: AV:N means the trigger can be delivered across trust boundaries (internet to mailbox) without adjacent-network positioning; AC:L means no race condition, unusual configuration, or repeated attempts are assessed as necessary; PR:N means the attacker needs no account or credentials on the target system to attempt delivery; UI:R is the single mitigating factor and confines the exploit to user-driven openings rather than automated compromise. S:U confirms the victim's Outlook process and user token define the compromised boundary, while C:H/I:H/A:H confirms that within that boundary the loss is total.

Business impact is concentrated where mail clients are high-value: Outlook is the primary endpoint for email, calendar, contacts, and often the gateway to Microsoft 365 and on-premises Exchange. A successful exploit provides attacker access to the identity context of the user — the single most valuable asset in most enterprises — enabling business email compromise, internal phishing from a trusted account, exfiltration of sensitive correspondence and documents, and fraudulent transactions. Blast radius is per-victim rather than worm-like (S:U, UI:R), but enterprises should assume that a single compromised mailbox can be leveraged for internal spear-phishing, making effective blast radius larger than the CVSS scope metric suggests. Availability impact (A:H) means ransomware or wiper behavior in the user context is feasible. No CISA KEV listing and no EPSS score currently exist, so there is no confirmed evidence of exploitation in the wild; that does not reduce the urgency of patch tracking given the severity.

Detection Guidance

Sigma Rule

title: Suspicious Child Process Spawned by Microsoft Outlook
id: 7c2f0a91-4a8e-4d3e-9b7a-1f5e2c8d9a10
status: experimental
description: Detects Outlook spawning unexpected child processes, consistent with client-side RCE via malicious message or attachment content (CVE-2026-70125). Requires environment-specific tuning.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-70125
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_legacy:
    Image|endswith:
      - '\outlook.exe'
  condition: selection_parent and selection_susp_child and not filter_legacy
falsepositives:
  - Legitimate third-party Outlook add-ins or enterprise macros launching shell utilities
  - IT automation targeting Outlook via COM from a trusted parent
level: high

YARA Rule

rule CVE_2026_70125_Outlook_RCE_Generic
{
    meta:
        description = "Generic heuristic for Outlook client-side RCE exploitation artifacts. No specific in-the-wild sample or byte signature is available for CVE-2026-70125; use for hunting only, expect false positives."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70125"
        cve = "CVE-2026-70125"
        severity = "high"
        date = "2026-01-01"

    strings:
        $mz = { 4D 5A }
        $hta = "<hta:application" ascii wide nocase
        $scriptlet = "scriptlet" ascii wide nocase
        $objclass = "CLSID" ascii wide nocase
        $powershell = "powershell" ascii wide nocase
        $mshta = "mshta" ascii wide nocase

    condition:
        $mz at 0 and (($hta or $scriptlet) or (2 of ($objclass, $powershell, $mshta)))
}

Suricata IDS Rule

alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-70125 Possible Microsoft Outlook RCE Attempt - Suspicious Scriptlet/HTA Attachment"; flow:established,to_server; content:"Content-Type|3a|"; nocase; content:".hta"; nocase; distance:0; content:"Content-Disposition|3a|"; nocase; content:".hta"; nocase; distance:0; classtype:attempted-user; sid:202670125; rev:1; metadata:cve CVE-2026-70125, created_at 2026_01_01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-70125;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "outlook.exe" and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                   "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
                   "certutil.exe", "bitsadmin.exe")

Splunk SPL Query

index=main source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  EventCode=1 ParentImage="*\\OUTLOOK.EXE"
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe"
   OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe"
   OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe")
| table _time, ComputerName, User, ParentImage, Image, CommandLine
| sort -_time

Wazuh OSSEC Rule

<group name="windows,sysmon,outlook_rce,">
  <rule id="100125" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\OUTLOOK\.EXE$</field>
    <field name="win.eventdata.image">\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$</field>
    <description>CVE-2026-70125: Microsoft Outlook spawned a suspicious child process, possible remote code execution</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>attack.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, NVD, claims a patch; this has not been independently confirmed by a vendor advisory or version diff in the supplied data). No vendor fix, KB article, or target version is available. Treat the following as interim and verify against Microsoft's official guidance once published.

1) Immediate mitigations

• Restrict Outlook from launching child processes by enforcing attack surface reduction (ASR) rules on Windows, particularly "Block all Office applications from creating child processes" and "Block Win32 API calls from Office macro."
• Block or quarantine high-risk attachment types at the email gateway and Exchange transport layer (scriptlet/HTA, script, executable, and container formats commonly used to deliver client-side RCE), and strip active content where business processes allow.
• Disable unnecessary Outlook add-ins and COM/OLE activation exported from untrusted sources; restrict OLE object activation policy via Trust Center and Group Policy.
• Enforce Protected View and disable automatic preview/rendering of untrusted message content where operationally feasible.
• Apply application allowlisting (WDAC/AppLocker) to constrain what Outlook can execute under the user token.

2) Patch / upgrade steps

• Monitor Microsoft's Security Update Guide and the MSRC advisory for CVE-2026-70125 for the affected build numbers and fix release. The supplied data contains no KB reference; do not assume any specific patch level.
• Once published, apply the update to Microsoft 365 Apps (Current/Enterprise/Monthly channels), Office LTSC, and all on-premises Exchange-connected Outlook clients. Prioritize externally facing and executive/high-value mailboxes.
• Validate patch application by build number inventory, not by update status alone, and re-scan after deployment.

3) Long-term hardening

• Reduce the attack surface of the mail client by enforcing attachment and content policy that aligns with zero-trust principles, and by segmenting administrative accounts away from mail clients.
• Adopt credential hygiene (phishing-resistant MFA, conditional access, session token protection) to blunt the impact of a single compromised mailbox.
• Maintain continuous endpoint telemetry (process creation with parent lineage) and alerting on Office-to-script interpreter process trees.
• Track CVE-2026-70125 in vulnerability management and re-evaluate severity if CISA KEV status changes, an EPSS score is assigned, or a public PoC emerges.

References

1. NVD — CVE-2026-70125: https://nvd.nist.gov/vuln/detail/CVE-2026-70125
2. Microsoft Security Update Guide (MSRC) — vendor advisories for Outlook: https://msrc.microsoft.com/update-guide
3. FIRST — EPSS (no score currently assigned to CVE-2026-70125): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-70125 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

Note: No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation (threat actor campaign or CISA KEV listing) is associated with CVE-2026-70125 in the available data. The technical analysis and detection content above are derived strictly from the provided NVD description and CVSS vector; specific implementation details are not asserted where source data does not support them.