Patch Tuesday, November 2021
Microsoft's monthly security release, Tuesday, November 9, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
5 CVEs · 0 critical · 5 exploited · 5 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
5 CVEs · 0 critical · 5 exploited · 5 with public exploit code
- 8.8HighNov 10, 2021Microsoft Exchange Code / command injectionCVE-2021-42321Microsoft Exchange Server is affected. An attacker gains remote code execution and potentially obtains sensitive information. Patch Microsoft Exchange Server with the latest updates and apply additional security hardening measures.Exploited92% likelyExploit codeMetasploitDetection
- 7.8HighNov 10, 2021Microsoft OfficeCVE-2021-42292A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.Exploited43% likelyExploit code
- 7.5HighNov 10, 2021Microsoft Active Directory Privilege escalationCVE-2021-42278Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.Exploited73% likelyExploit codeDetection
- 7.5HighNov 10, 2021Microsoft Active Directory Privilege escalationCVE-2021-42287Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.Exploited77% likelyExploit codeDetection
- 5.5MediumNov 10, 2021Microsoft Windows Privilege escalationCVE-2021-41379Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.Exploited19% likelyExploit codeDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.