[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6Dk1oLzuSikWdl1b_ciMXVqXxxD_WH3hWssH1KcahCo":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":35},"93f9d25d-a78d-48b3-949b-58b473fb654d","Microsoft Fixes Nearly 1,100 Security Vulnerabilities","microsoft-fixes-nearly-1-100-security-vulnerabilities-6e299c","Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- including a zero-day in Microsoft Outlook -- and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.","Microsoft has released its November Patch Tuesday updates, addressing 1,093 vulnerabilities across its Windows operating systems and supported software. This includes 63 critical flaws, with one zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) already being actively exploited. The company attributes its ability to find and fix a large volume of bugs to advances in artificial intelligence.","Microsoft releases nearly 1,100 security updates, including a zero-day in Outlook.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F11\u002Fmicrosoft-fixes-nearly-1100-security-vulnerabilities\u002F",null,"2026-11-10T21:55:03+00:00","2026-11-10T22:00:14.077102+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows","product",{"name":24,"type":22},"Microsoft Outlook",{"name":26,"type":19},"Adobe",{"name":28,"type":19},"Apple",{"name":30,"type":19},"Google","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":12,"name":33,"slug":34},"Vulnerabilities","vulnerabilities",[36,41],{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":31,"icon":12,"name":33,"slug":34},[44,48],{"type":45,"value":46,"context":47},"cve","CVE-2026-124194","Spoofing bug in Outlook, actively exploited.",{"type":45,"value":49,"context":50},"CVE-2026-125350","Zero-day vulnerability in Google Chrome.",[18,26,28],{"controls":53,"vendors":125},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[117,118],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},{"vendor_slug":119,"vendor_name":18,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[126],{"slug":119,"name":18,"logo_path":120,"roles":127},[128],"affected",{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":139},"microsofts-1093-vulnerability-patch-tuesday-underscores-urgency-of-rapid-patching","Microsoft's 1,093-Vulnerability Patch Tuesday Underscores Urgency of Rapid Patching","Microsoft's November Patch Tuesday addressed a staggering 1,093 vulnerabilities, including 63 critical flaws and an actively exploited zero-day in Microsoft Outlook (CVE-2026-124194). The sheer volume of patches highlights how complex, widely deployed software continuously accumulates security debt that attackers actively probe. The actively exploited Outlook zero-day is especially dangerous because it targets a ubiquitous communication tool, meaning unpatched organizations are exposed to real-world attacks right now. This event underscores that patch management must be treated as a time-sensitive operational priority, not a routine maintenance task.",[134,135,136,137,138],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":140,"NIST SP 800-53 SI-2: Flaw Remediation":141,"CIS Control 7: Continuous Vulnerability Management (v8)":142,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":143,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":144},"NIS2 Article 21(2)(e) covers vulnerability handling and disclosure in acquisition, development, and maintenance, requiring entities to have processes to rapidly address vulnerabilities like those disclosed in this Patch Tuesday.","SI-2 requires organizations to identify, report, and correct information system flaws within defined time frames, which is precisely what organizations must now execute for the November Patch Tuesday vulnerabilities.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, directly addressing the need to prioritize and rapidly apply the 63 critical patches and the actively exploited Outlook zero-day.","This control requires timely identification and remediation of technical vulnerabilities, making it directly applicable to the obligation organizations now have to patch 1,093 disclosed Microsoft vulnerabilities.","This category directly applies because organizations must act to mitigate the actively exploited Outlook zero-day or formally document any decision to delay patching as an accepted risk."]