My Next Class

Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS score of 10.

Microsoft Patch Tuesday
Microsoft is addressing 1,260 vulnerabilities this month, 68 of them critical, including 167 Chromium issues that affect Microsoft Edge. One already exploited Outlook spoofing vulnerability, CVE-2026-124194, may hide the risk of a file being opened, in a Mark of the Web style issue, though Microsoft does not rate it critical. Other notable critical issues include a Lightweight Directory Access Protocol (LDAP) remote code execution flaw in Active Directory environments (CVE-2026-119958), five critical Microsoft Queuing and Queue Manager bugs, and a Windows TCP/IP remote code execution vulnerability (CVE-2026-113859) that Microsoft rates critical despite a 7.5 Common Vulnerability Scoring System (CVSS) score.
https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+November+2027/33508

Apple Patches
Apple released updates for iOS, iPadOS, macOS, watchOS, and visionOS that fix only nine vulnerabilities, with iPadOS and macOS patches going back to version 18, watchOS one version back, and visionOS only for the current release. Most of the issues weaken the Bluetooth handshake so an attacker can pair with a phone or Mac, and there are also AirPlay rate-limiting problems; one vulnerability only affects an older iOS release and lets an attacker with physical access pair a locked device with an AirPlay receiver. A more notable iMessage issue may let someone join a group and receive its messages without being invited. Apple states that none of these bugs are being exploited.
https://isc.sans.edu/diary/Apple+Patches+Everyting+November+2026+Edition/33506/

SAP Patch Tuesday
SAP's November Security Patch Day, issued in sync with Microsoft's, includes four vulnerabilities with a perfect CVSS score of 10, three more at 9.9, and two more in the nines, including issues in SAP NetWeaver. Onapsis reported a broken access control flaw in SAP Gateway (CVE-2026-89103) tied to the proxy access control list, and a WebSocket memory-corruption bug that Onapsis has shown as a denial of service but says can also allow remote code execution (CVE-2026-76964 and CVE-2026-89126).
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/
https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.