{"id":26326,"date":"2026-11-11T06:00:12","date_gmt":"2026-11-11T14:00:12","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/11\/11\/microsoft-fixes-nearly-1100-security-vulnerabilities\/"},"modified":"2026-11-11T06:00:12","modified_gmt":"2026-11-11T14:00:12","slug":"microsoft-fixes-nearly-1100-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/11\/11\/microsoft-fixes-nearly-1100-security-vulnerabilities\/","title":{"rendered":"Microsoft Fixes Nearly 1,100 Security Vulnerabilities"},"content":{"rendered":"

Microsoft<\/strong> did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows<\/strong> operating systems and supported software. This month\u2019s Patch Tuesday addresses 63 critical flaws \u2014 including a zero-day in Microsoft Outlook<\/strong> \u2014 and comes amid important security updates from other software makers, including Adobe<\/strong>, Apple<\/strong>, Google<\/strong>\u00a0and Mozilla<\/strong>.<\/p>\n

\"\"<\/p>\n

Image: Shutterstock.com. Diorama by @zepp1969.<\/p>\n<\/div>\n

November\u2019s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 \u201ccritical\u201d flaws that can be exploited to seize control over a Windows system with little or no help from users. Nearly half of those critical bugs are remote code execution vulnerabilities. Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device.<\/p>\n

This latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month. Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months. Last month, Microsoft pushed more than 1,400 fixes.<\/p>\n

According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194<\/a>, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise<\/strong> and editions of Microsoft Office<\/strong>.<\/span><\/p>\n

Several other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS\/iPadOS<\/strong>, macOS<\/strong>, watchOS<\/strong> and visionOS<\/strong>. Among the weaknesses reportedly fixed<\/a> in Apple\u2019s release include an iMessage<\/strong> flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.<\/p>\n

Lee Neely<\/strong>, an instructor at the SANS Institute<\/strong>, noted that Apple backported the fix to iOS 18.<\/p>\n

\u201cI take notice when Apple releases fixes to more than two versions,\u201d Neely wrote in a SANS newsletter today. \u201cYou really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware. Run through all your Apple devices and make sure everything is up to date, don\u2019t assume the fixes went out automatically.\u201d<\/p>\n

Google this week released Chrome version 157.0.8103.50<\/em><\/a>, which resolves nine security holes, including\u00a0CVE-2026-125350<\/a>, the sixth zero-day vulnerability this year for Chrome (this bug also being patched in Chromium-based browsers like Edge). The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities. A new version of Mozilla Firefox<\/strong> out today (Firefox 160<\/em>) resolves almost 100 CVEs, about half of them high severity.<\/p>\n

Adobe today released patches for at least 110 vulnerabilities<\/a> across a range of products, with nearly half of the flaws rated high severity. Adobe said there is no evidence any of the security holes it addressed this month are being actively exploited.<\/p>\n

Chris Goettl<\/strong>, vice president of product management at Ivanti<\/strong>, said it\u2019s easy for security teams at large enterprises to feel overwhelmed by the volume and criticality of patches from Microsoft lately. But he notes that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have so far this year been added to the Known Exploited Vulnerabilities (KEV) list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

\u201cRoughly four in ten of this year\u2019s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,\u201d Goettl said.\u201dThe rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.\u201d<\/p>\n

Please don\u2019t neglect to back up any important data if you haven\u2019t recently; generally speaking, this is a task best accomplished before<\/em> applying operating system updates. As ever, if you experience any issues applying this month\u2019s bundle of love from Microsoft, please drop a comment about it in the space below.<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoftdid another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in itsWindowsoperating systems and supported software. This month\u2019s Patch Tuesday addresses 63 critical flaws \u2014 including a zero-day inMicrosoft Outlook\u2014 and comes amid important security updates from other software makers, includingAdobe,Apple,GoogleandMozilla.Image: Shutterstock.com. Diorama by @zepp1969.November\u2019s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10642],"tags":[],"class_list":["post-26326","post","type-post","status-publish","format-standard","hentry","category-krebs"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26326"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26326\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}