[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7STycYVE3fZu9YtvzOe-TG9ej29Ey5_pgwLfG4R0zsg":3},{"article":4,"iocs":45,"watch_terms":114,"solutions":115,"lesson":212},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"83a042d8-53fb-4d40-b1ac-6f213416cb31","Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities","microsoft-patch-tuesday-for-november-2026-snort-rules-and-prominent-vulnerabilit-d88b3f","Microsoft has released its monthly security update for November 2026, which includes 1328 vulnerabilities affecting a range of products, including 60 that Microsoft marked as \"critical.\" Out of 60 \"critical\" vulnerabilities, 45 are remote code execution (RCE) vulnerabilities.","Microsoft's November 2026 Patch Tuesday update addresses 1095 vulnerabilities across its product range, with 64 classified as critical. Of these critical flaws, 48 are remote code execution (RCE) vulnerabilities. One vulnerability, CVE-2026-124194 affecting Microsoft Office Outlook, has been exploited in the wild.","Microsoft November 2026 Patch Tuesday addresses 1095 vulnerabilities, including 64 critical ones.","https:\u002F\u002Fblog.talosintelligence.com\u002Fmicrosoft-patch-tuesday-for-november-2026\u002F","https:\u002F\u002Fstorage.ghost.io\u002Fc\u002Faf\u002Fa0\u002Fafa04ee3-414f-4481-8d23-7e7c146f192e\u002Fcontent\u002Fimages\u002Fsize\u002Fw1200\u002F2022\u002F10\u002FGnericCiscoTalos-Header-1.jpg","2026-11-11T01:41:17+00:00","2026-11-11T02:00:25.820214+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Office Outlook","product",{"name":24,"type":22},"Windows Network Address Translation (NAT)",{"name":26,"type":27},"Active Directory Domain Services","technology",{"name":29,"type":22},"Microsoft Exchange Server",{"name":31,"type":22},"Windows Schannel","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,56,59,62,65,68,70,73,75,77,80,82,84,86,89,91,94,97,100,102,104,106,108,110,112],{"type":47,"value":48,"context":49},"cve","CVE-2026-124194","Exploited in the wild vulnerability in Microsoft Office Outlook",{"type":47,"value":51,"context":52},"CVE-2026-113862","Critical RCE vulnerability in Windows Network Address Translation (NAT)",{"type":47,"value":54,"context":55},"CVE-2026-118146","Critical RCE vulnerability in Active Directory Domain Services",{"type":47,"value":57,"context":58},"CVE-2026-118148","Critical elevation of privilege vulnerability in Active Directory Domain Services",{"type":47,"value":60,"context":61},"CVE-2026-118207","Critical RCE vulnerability in Microsoft Exchange Server",{"type":47,"value":63,"context":64},"CVE-2026-119952","Critical RCE vulnerability in Windows Schannel",{"type":47,"value":66,"context":67},"CVE-2026-109459","RCE vulnerability in Windows Message Queuing Queue Manager",{"type":47,"value":69,"context":67},"CVE-2026-119967",{"type":47,"value":71,"context":72},"CVE-2026-110043","RCE vulnerability in Microsoft Office Outlook",{"type":47,"value":74,"context":72},"CVE-2026-110068",{"type":47,"value":76,"context":72},"CVE-2026-111309",{"type":47,"value":78,"context":79},"CVE-2026-110047","RCE vulnerability in Microsoft Office Word",{"type":47,"value":81,"context":79},"CVE-2026-110067",{"type":47,"value":83,"context":79},"CVE-2026-111285",{"type":47,"value":85,"context":79},"CVE-2026-124185",{"type":47,"value":87,"context":88},"CVE-2026-111289","RCE vulnerability in Microsoft Office",{"type":47,"value":90,"context":88},"CVE-2026-120003",{"type":47,"value":92,"context":93},"CVE-2026-112967","RCE vulnerability in Windows Xbox Live Networking Service",{"type":47,"value":95,"context":96},"CVE-2026-113752","RCE vulnerability in Windows Print Spooler Components",{"type":47,"value":98,"context":99},"CVE-2026-113753","Elevation of privilege vulnerability in Windows Hyper-V",{"type":47,"value":101,"context":99},"CVE-2026-113856",{"type":47,"value":103,"context":99},"CVE-2026-113860",{"type":47,"value":105,"context":99},"CVE-2026-113861",{"type":47,"value":107,"context":99},"CVE-2026-113865",{"type":47,"value":109,"context":99},"CVE-2026-119947",{"type":47,"value":111,"context":99},"CVE-2026-119960",{"type":47,"value":113,"context":99},"CVE-2026-113864",[18,21,24],{"controls":116,"vendors":202},[117,146,174],{"slug":118,"name":119,"problem":120,"products":121},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":147,"name":148,"problem":149,"products":150},"patch-management","Automated patch management","Known holes get closed in days, not months.",[151,159,166],{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":160,"vendor_name":18,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":167,"vendor_name":168,"vendor_logo":169,"product_slug":170,"product_name":171,"url":172,"description":173},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":44,"name":175,"problem":176,"products":177},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[178,186,194],{"vendor_slug":179,"vendor_name":180,"vendor_logo":181,"product_slug":182,"product_name":183,"url":184,"description":185},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":187,"vendor_name":188,"vendor_logo":189,"product_slug":190,"product_name":191,"url":192,"description":193},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":195,"vendor_name":196,"vendor_logo":197,"product_slug":198,"product_name":199,"url":200,"description":201},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[203,209],{"slug":204,"name":205,"logo_path":206,"roles":207},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[208],"reported_by",{"slug":160,"name":18,"logo_path":161,"roles":210},[211],"affected",{"slug":213,"title":214,"body":215,"framework_refs":216,"framework_notes":222},"1095-vulnerabilities-in-one-patch-tuesday-highlights-systemic-patching-risk","1,095 Vulnerabilities in One Patch Tuesday Highlights Systemic Patching Risk","Microsoft's November 2026 Patch Tuesday addressed 1,095 vulnerabilities, including 64 critical flaws—48 of which enable remote code execution—and one actively exploited zero-day in Microsoft Office Outlook (CVE-2026-124194). The sheer volume of critical patches underscores the persistent challenge organizations face in maintaining timely remediation at scale. The in-the-wild exploitation of the Outlook vulnerability means that any organization running an unpatched version is already exposed to active threat actors. Delayed patching, especially for widely deployed productivity software like Outlook, creates a window of opportunity that adversaries routinely exploit for initial access and lateral movement.",[217,218,219,220,221],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":223,"NIST SP 800-53 SI-2: Flaw Remediation":224,"CIS Control 7: Continuous Vulnerability Management (v8)":225,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":226,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":227},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling and disclosure, making timely patching of critical RCE flaws a regulatory obligation for in-scope organizations.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time periods, which directly applies to the failure to patch the actively exploited Outlook vulnerability promptly.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying a structured, prioritized patching process would have closed CVE-2026-124194 before it was exploited in the wild.","A.8.8 requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly covering the need to rapidly apply patches for actively exploited flaws like CVE-2026-124194.","This category requires that known vulnerabilities—especially those under active exploitation like CVE-2026-124194—are acted upon immediately rather than left open during extended patch cycles."]