This vulnerability (CVE-2026-21511) is classified under CWE-502, deserialization of untrusted data, in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise version 16.0.1. It allows an attacker to perform spoofing over a network without requiring privileges or user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, and an official fix is available. The product is cloud-hosted, and Microsoft manages patch deployment. No known active exploitation has been reported.

An attacker exploiting this vulnerability could spoof network communications, potentially misleading users or systems by impersonating trusted entities. The confidentiality of information could be compromised, but integrity and availability are not affected. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft, and since this is a cloud service, Microsoft manages the remediation on their servers. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21511 for detailed patching instructions and confirmation of remediation status.