Hot on the heels of its record Patch Tuesday rollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities.
Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane.
In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it.
Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors.
Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint.
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite.
Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js.
According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day.
On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac.
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
F5, Juniper Networks Patch Critical Vulnerabilities
Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.
Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks.
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.
SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
