Microsoft Fixes About 1,235 Flaws in November Patch; Outlook Zero-Day Already Exploited

At a glance

Microsoft fixed about 1,235 security flaws in its November regular update. One Outlook flaw was already used in real attacks before a patch came out.

Key points

1. 1

   66 flaws are rated critical, the highest level, and nearly half of all fixes affect Windows.

2. 2

   The Outlook flaw could let attackers get Windows login data (an NTLM hash) just from a mail being opened.

3. 3

   Microsoft rated this flaw as moderate and said an attack needs a network connection and user action.

4. 4

   Updates were released for Windows 11 and Windows 10, and individuals can install them through Windows Update.

Why it matters

Once a patch is public, attackers study it and target systems that have not updated, so the risk grows the longer updates are delayed.