Patch days / November 2021

Microsoft Patch Tuesday — November 2021

Tuesday, 9 November 2021

Vulnerabilities: 54
Critical: 1
High: 28
Zero-days: 0
Public exploit: 7

Exploited 5

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2021-42321 Exploited Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 92%
High 7.8
CVE-2021-42292 Exploited Public exploit Microsoft Excel Security Feature Bypass Vulnerability
EPSS 43%
High 7.5
CVE-2021-42278 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 73%
High 7.5
CVE-2021-42287 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 77%
Medium 5.5
CVE-2021-41379 Exploited Windows Installer Elevation of Privilege Vulnerability
EPSS 19%

Critical 1

Critical 9.0
CVE-2021-26443 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
EPSS 1.7%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2021-38666 Public exploit Remote Desktop Client Remote Code Execution Vulnerability
EPSS 15%
Medium 6.5
CVE-2021-41349 Public exploit Microsoft Exchange Server Spoofing Vulnerability
EPSS 93%
Medium 4.3
CVE-2021-41351 Public exploit Microsoft Edge (Chrome based) Spoofing on IE Mode
EPSS 3.9%

All vulnerabilities 54

Critical1 Show

Critical 9.0
CVE-2021-26443 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
EPSS 1.7%

High28 Show

High 8.8
CVE-2021-42321 Exploited Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 92%
High 7.8
CVE-2021-42292 Exploited Public exploit Microsoft Excel Security Feature Bypass Vulnerability
EPSS 43%
High 7.5
CVE-2021-42278 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 73%
High 7.5
CVE-2021-42287 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 77%
High 8.8
CVE-2021-38666 Public exploit Remote Desktop Client Remote Code Execution Vulnerability
EPSS 15%
High 8.8
CVE-2021-42275 Microsoft COM for Windows Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2021-42283 NTFS Elevation of Privilege Vulnerability
High 8.8
CVE-2021-42316 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-36957 Windows Desktop Bridge Elevation of Privilege Vulnerability
High 7.8
CVE-2021-40442 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-41366 Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
High 7.8
CVE-2021-41367 NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-41370 NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-41377 Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2021-41378 Windows NTFS Remote Code Execution Vulnerability
EPSS 1.6%
High 7.8
CVE-2021-42276 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
EPSS 2.5%
High 7.8
CVE-2021-42285 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2021-42286 Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability
High 7.8
CVE-2021-42296 Microsoft Word Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2021-42298 Microsoft Defender Remote Code Execution Vulnerability
EPSS 5.8%
High 7.8
CVE-2021-42322 Visual Studio Code Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43208 3D Viewer Remote Code Execution Vulnerability
EPSS 4.3%
High 7.8
CVE-2021-43209 3D Viewer Remote Code Execution Vulnerability
EPSS 6.8%
High 7.6
CVE-2021-41372 Power BI Report Server Spoofing Vulnerability
High 7.5
CVE-2021-41356 Windows Denial of Service Vulnerability
EPSS 3%
High 7.5
CVE-2021-42282 Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 4.2%
High 7.5
CVE-2021-42291 Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 4.2%
High 7.4
CVE-2021-38665 Remote Desktop Protocol Client Information Disclosure Vulnerability
EPSS 7%

Medium21 Show

Medium 5.5
CVE-2021-41379 Exploited Windows Installer Elevation of Privilege Vulnerability
EPSS 19%
Medium 6.8
CVE-2021-42274 Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
Medium 6.8
CVE-2021-42284 Windows Hyper-V Denial of Service Vulnerability
EPSS 3.8%
Medium 6.7
CVE-2021-41374 Azure Sphere Information Disclosure Vulnerability
Medium 6.6
CVE-2021-42302 Azure RTOS Elevation of Privilege Vulnerability
Medium 6.6
CVE-2021-42303 Azure RTOS Elevation of Privilege Vulnerability
Medium 6.6
CVE-2021-42304 Azure RTOS Elevation of Privilege Vulnerability
Medium 6.5
CVE-2021-41349 Public exploit Microsoft Exchange Server Spoofing Vulnerability
EPSS 93%
Medium 6.5
CVE-2021-42305 Microsoft Exchange Server Spoofing Vulnerability
EPSS 7.9%
Medium 6.1
CVE-2021-41368 Microsoft Access Remote Code Execution Vulnerability
EPSS 5%
Medium 6.0
CVE-2021-42300 Azure Sphere Tampering Vulnerability
Medium 5.7
CVE-2021-42288 Windows Hello Security Feature Bypass Vulnerability
Medium 5.5
CVE-2021-41373 FSLogix Information Disclosure Vulnerability
Medium 5.5
CVE-2021-42277 Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
Medium 5.5
CVE-2021-42280 Windows Feedback Hub Elevation of Privilege Vulnerability
Medium 4.7
CVE-2021-42319 Visual Studio Elevation of Privilege Vulnerability
Medium 4.4
CVE-2021-38631 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
EPSS 1.9%
Medium 4.4
CVE-2021-41371 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
EPSS 1.6%
Medium 4.4
CVE-2021-41375 Azure Sphere Information Disclosure Vulnerability
Medium 4.3
CVE-2021-41351 Public exploit Microsoft Edge (Chrome based) Spoofing on IE Mode
EPSS 3.9%
Medium 4.2
CVE-2021-42279 Chakra Scripting Engine Memory Corruption Vulnerability
EPSS 2.3%

Low4 Show

Low 3.3
CVE-2021-26444 Azure RTOS Information Disclosure Vulnerability
EPSS 1.6%
Low 3.3
CVE-2021-42301 Azure RTOS Information Disclosure Vulnerability
EPSS 1.1%
Low 3.3
CVE-2021-42323 Azure RTOS Information Disclosure Vulnerability
EPSS 1.4%
Low 2.3
CVE-2021-41376 Azure Sphere Information Disclosure Vulnerability