November Patch Tuesday: Over 1,250 Vulnerabilities and an Exploited Outlook Zero-Day

Microsoft has released its November Patch Tuesday, an exceptionally large update covering approximately 1,250 CVEs, 68 of which are classified as critical. The top priority for defenders is an Outlook zero-day that was already being actively exploited when the updates were released. The package also affected highly exposed components such as Exchange, SharePoint, Windows Search, and LDAP, as well as numerous Chromium vulnerabilities incorporated into Microsoft Edge. The high number of fixes increases the risk that organizations will focus solely on CVSS scores, overlooking Internet exposure, required privileges, and the potential for lateral movement. Organizations should therefore accelerate patch testing and deployment, prioritizing the zero-day and externally accessible email, collaboration, and identity systems.

Source: CrowdStrike Blog