Patch Tuesday, November 2018
Microsoft's monthly security release, Tuesday, November 13, 2018. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.4HighNov 14, 2018Microsoft Exchange Server Privilege escalationCVE-2018-8581Microsoft Exchange Server's Web Services is affected. An attacker gains elevated privileges on the Exchange Server. Patch the Exchange Server with the latest security updates.Exploited27% likelyExploit code
- 7.8HighNov 14, 2018Microsoft Win32k Privilege escalationCVE-2018-8589A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.Exploited3% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.