Microsoft did one other four-digit patch drop as we speak, releasing updates to repair virtually 1,100 safety vulnerabilities in its Home windows working techniques and supported software program. This month’s Patch Tuesday addresses 63 essential flaws — together with a zero-day in Microsoft Outlook — and comes amid vital safety updates from different software program makers, together with Adobe, Apple, Google and Mozilla.
Picture: Shutterstock.com. Diorama by @zepp1969.
November’s patch launch from Redmond tackles 1,093 vulnerabilities, fixing 63 “essential” flaws that may be exploited to grab management over a Home windows system with little or no assist from customers. Practically half of these essential bugs are distant code execution vulnerabilities. General, 535 of the issues addressed this month enable an attacker to raise their privileges on a susceptible machine.
This newest spherical of updates means Microsoft has shipped greater than 5,100 safety patches thus far this 12 months, a staggering quantity contemplating {that a} 12 months in the past Microsoft was averaging round 100 patches monthly. Microsoft credit advances in synthetic intelligence for serving to to search out (and repair) such a big quantity of safety bugs in current months. Final month, Microsoft pushed greater than 1,400 fixes.
In line with Redmond, simply one of many flaws is already seeing lively exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it impacts Microsoft 365 Apps for Enterprise and editions of Microsoft Workplace.
A number of different main software program makers pushed safety updates this week to repair essential weaknesses of their merchandise. Apple on Monday launched out-of-cycle safety updates to repair a minimum of 9 vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS. Among the many weaknesses reportedly fastened in Apple’s launch embrace an iMessage flaw that would let a distant attacker be a part of a bunch chat and obtain its messages; the updates additionally repair a separate iMessage flaw that would let somebody added to a bunch entry messages despatched earlier than they joined.
Lee Neely, an teacher on the SANS Institute, famous that Apple backported the repair to iOS 18.
“I take discover when Apple releases fixes to greater than two variations,” Neely wrote in a SANS e-newsletter as we speak. “You actually need to get to model 27.2.1 of their OSes and push of us who’re holding onto units which can not run the present model. The perfect plan typically entails setting an improve date for outdated {hardware}. Run by all of your Apple units and ensure every thing is updated, don’t assume the fixes went out routinely.”
Google this week launched Chrome model 157.0.8103.50, which resolves 9 safety holes, together with CVE-2026-125350, the sixth zero-day vulnerability this 12 months for Chrome (this bug additionally being patched in Chromium-based browsers like Edge). The most recent Chrome model follows its November 3 launch, which fastened 213 vulnerabilities. A brand new model of Mozilla Firefox out as we speak (Firefox 160) resolves virtually 100 CVEs, about half of them excessive severity.
Adobe as we speak launched patches for a minimum of 110 vulnerabilities throughout a variety of merchandise, with almost half of the issues rated excessive severity. Adobe stated there is no such thing as a proof any of the safety holes it addressed this month are being actively exploited.
Chris Goettl, vp of product administration at Ivanti, stated it’s simple for safety groups at giant enterprises to really feel overwhelmed by the quantity and criticality of patches from Microsoft these days. However he notes that whereas some 95,000 vulnerabilities have been assigned CVEs this 12 months throughout all distributors, solely 217 have thus far this 12 months been added to the Identified Exploited Vulnerabilities (KEV) record maintained by the U.S. Cybersecurity and Infrastructure Safety Company (CISA).
“Roughly 4 in ten of this 12 months’s exploited vulnerabilities sit in working techniques, endpoint software program, browsers, and server platforms, which a steady patch technique can shut rapidly,” Goettl stated.”The remaining requires publicity administration alongside patching, particularly the 44% that sit in edge units and IT administration or distant entry instruments, the internet-facing techniques that maintain privileged entry. Groups that may rapidly determine these belongings, affirm publicity and act on confirmed exploitation can concentrate on the small slice of vulnerabilities attackers are actively utilizing, whereas the remaining stays on the conventional patch cadence.”
Please don’t neglect to again up any vital information when you haven’t not too long ago; typically talking, this can be a process greatest completed earlier than making use of working system updates. As ever, when you expertise any points making use of this month’s bundle of affection from Microsoft, please drop a remark about it within the house beneath.
