What happened
Microsoft released patches for 1,259 vulnerabilities across its software portfolio, according to The Hacker News. This is the second consecutive month in which the reported patch volume has exceeded 1,000 flaws. The release includes 165 non-Microsoft-issued CVE identifiers. The reported headline identifies an exploited Microsoft Outlook bug that may expose NTLMv2 hashes. Exploitation of the flaw is confirmed in the wild, and it was exploited before it was publicly known. A fix is available. No CVSS score has been published, so no severity level is stated here. The supplied information does not describe the exploitation path or the conditions under which hashes may be exposed. It also does not provide technical indicators or fixed version numbers.
Who is affected
Organisations running Microsoft Outlook, Microsoft Windows, Microsoft Office, Microsoft Developer Tools, Microsoft SQL Server or Microsoft SharePoint Server may be affected by vulnerabilities covered by the release. The specific affected versions are not available in the supplied information. The confirmed active exploitation and possible NTLMv2 hash exposure relate to the Outlook bug; the supplied facts do not attribute those details to the other products.
Recommended actions
- Apply the available fixes relevant to affected Microsoft products; the supplied information does not specify version numbers.
- Prioritise applying the Outlook fix because exploitation of the bug is confirmed in the wild and the reported potential impact is exposure of NTLMv2 hashes.
- Review Microsoft’s patch information to determine affected and fixed versions, as those details are not available in the supplied facts.
