Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2026-21260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2026-21511, CVE-2026-21260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Word Products are missing a security update. They are, therefore, affected by multiple spoofing vulnerabilities:

  - Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing     over a network. (CVE-2026-21511)

  - A spoofing vulnerability in Microsoft Office Word allows an unauthorized attacker to perform spoofing over a     network. (CVE-2026-21260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2026-21511, CVE-2026-21260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2026-21260,     CVE-2026-62551, CVE-2026-62563)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2026-21511, CVE-2026-21260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298974	Security Updates for Outlook (February 2026)	Nessus	Windows	high
298565	Security Updates for Microsoft SharePoint Server 2016 (February 2026)	Nessus	Windows : Microsoft Bulletins	high
298560	Security Updates for Microsoft Word Products (February 2026)	Nessus	Windows : Microsoft Bulletins	high
298559	Security Updates for Microsoft SharePoint Server Subscription Edition (February 2026)	Nessus	Windows : Microsoft Bulletins	high
298550	Security Updates for Microsoft SharePoint Server 2019 (February 2026)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2026-21260

high

Tenable Plugins

high

high

high

high

high