An Outlook risk score changed. The patch action stayed the same. For an MSP, the useful response is to correct the exposure description and verify the Office update already deployed.
What changed — October 30, 2026: Microsoft revised CVE-2026-70125 to CVSS 3.1 7.8, from 8.8, changing the attack vector from network to local. Microsoft describes heap-based buffer overflow allowing code execution locally; its FAQ requires an attacker to send a malicious Office file and convince the user to open it. Vendor severity remains Important. This is a risk clarification, with no new patch identified.
Original vendor publication: September 23, 2026. Last verified: October 30, 2026. Microsoft’s September revision says the vulnerability was addressed by the September 2026 updates but omitted from the release advisory; customers who already installed those updates need no additional action for this revision.
Check the installed Office product and channel
Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, on both 32-bit and x64 systems. Do not assume a customer uses these products. Match the installed product, servicing channel and build before assigning a remediation task.
The current CVRF and Microsoft-authored CNA record direct fixed-version checks to the Office security release guide. Their version boundary is a URL, not a usable build number. The accessible guide did not list CVE-2026-70125 explicitly during this check, so a complete CVE-specific affected/fixed build matrix is not verified here. Use Microsoft’s supported channel guidance; do not compare unrelated channel builds or treat the score reduction as proof an unpatched installation is safe.
Exploitation and priority
Microsoft reports Exploited: No, Publicly disclosed: No and Exploitation less likely. The CVE is absent from the reviewed CISA KEV catalog. These are distinct from a guarantee that exploitation cannot occur. No KEV federal deadline applies. The published vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.
Suggested MSP priority: prioritize applicable installations missing the September fix or a supported superseding update; treat already updated installations as a record and verification task. This is our operational recommendation, separate from Microsoft’s Important rating.
MSP action sequence
Inventory → contain if warranted → update → verify. Record Office product, architecture, channel and installed build across relevant endpoints. If suspicious file execution is observed, preserve evidence and follow the authorized endpoint incident-response process. For installations missing the fix, deploy the supported Click-to-Run security update through the customer’s established Office management process. Verify the installed and loaded application version, update-policy compliance, Outlook connectivity and normal Office workflows. Refresh scanner notes to reflect the user-opened-file prerequisite and revised attack vector.
No complete vendor workaround, new mandatory credential rotation or CVE-specific compromise-recovery procedure was verified. Patching and a lower score do not establish that a previously compromised endpoint is clean.
Official sources
MSRC: CVE-2026-70125 · MSRC September CVRF, revision 1.3 · Microsoft-authored CNA record · Office security updates by channel · CISA KEV catalog