Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register: “Maybe we should just go home.” “Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,” Knott told us. Starting with the zero-day: It’s an Outlook spoofing vulnerability, tracked as CVE-2026-124194, and it only garnered a 6.5 out of 10 CVSS rating.
But as Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warns, don’t let the score or the name lull you into thinking it’s OK to put off patching this one. “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review.
