SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10174.mp3

previous

Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday November 11th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My name is Johannes
 Ullrich, recording today from Washington DC. And this
 episode is brought to you by the SANS.edu, Graduate
 Certificate Program in Cybersecurity Leadership. And
 of course today Microsoft Patch Tuesday is at the top of
 the news and the AI induced patch surge continues with
 Microsoft. Microsoft is addressing 1260 different
 vulnerabilities this month. 68 of these vulnerabilities are
 considered critical. Now out of these vulnerabilities there
 are 167 vulnerabilities that are actually Chromium
 vulnerabilities. And yes they affect Microsoft Edge. That's
 why Microsoft is including them in their patch lists. But
 not really sort of a Microsoft product per se. And we haven't
 always included them. Depends a little bit on how Microsoft
 is representing them in their vulnerability feed. But still
 a lot of vulnerabilities sort of in line with what we had
 the last couple months from Microsoft. Now I picked a
 couple vulnerabilities here that I considered somewhat
 more significant. Of course I have to start with the one
 vulnerability that's already being exploited. That's an
 Outlook spoofing vulnerability. And apparently
 Outlook will not really tell you the risk of a particular
 file when you're opening it. So probably one of those Mark
 of the Web style vulnerabilities that is being
 exploited here. Nothing too serious and Microsoft also
 does not rate this vulnerability critical. And
 definitely something that you want to take care of. Now as
 far as the critical vulnerabilities are concerned.
 There are sort of three groups really that I'm paying a
 little bit more attention to. One is remote code execution
 vulnerability in Microsoft LDAP. LDAP of course they're
 used throughout the sort of Active Directory ecosystem. So
 there's certainly some at least internal exposure here.
 And something that you have to watch out for. Yes and please
 don't expose it to the internet. And then we have a
 number of different vulnerabilities. I listed five
 in the diary. These are all critical vulnerabilities that
 relate to Microsoft Queuing, Queue Manager. This sort of a
 group of issues that keeps coming up around Queue
 Manager. Definitely something I haven't seen a lot of
 exploit out there yet. But haven't really been looking
 that much at it either. Definitely something that
 tends to be exposed at least internally. Something that you
 must pay attention to. And then we do have sort of
 interestingly Windows TCP/IP remote code execution
 vulnerability. Has a fairly low CVSS score, 7.5. But
 Microsoft still rates it critical. Will be interesting
 to see a little bit more detail about this particular
 vulnerability. Given all the issues we had sort of in the
 Linux world. With like the Multipath TCP option issue
 and such. So maybe there's something related going on in
 Windows as well. Other than that, yes lots and lots of
 vulnerabilities. So too much to really talk about them all
 in detail. But again only one that's already being
 exploited. And otherwise, yes just a lot of them. Nothing
 really that sort of in my opinion sticks out that much.
 Just apply those patches before the next month's
 release comes out. But then we also got patches from Apple.
 iOS, iPadOS, macOS, watchOS and visionOS are being
 addressed in these patches. Only nine different
 vulnerabilities. We're not yet seeing sort of that AI surge
 from Apple as we're seeing from Microsoft. There's of
 course always a possibility of some silent patching happening
 here. But yeah, a fairly small patch set. What Apple however
 is doing that we are seeing more sort of of these
 incremental updates. So that may be hiding a little bit the
 total number of patches. But last time I checked really it
 didn't go up like by orders of magnitude. It's like what
 we're seeing with Microsoft. Now for iPadOS we are getting
 patches back to 18. Same for macOS. watchOS we only get
 sort of one version back. And visionOS just for the current
 version. Now as far as the older versions go. One of the
 vulnerabilities actually only affects the older version of
 iOS. And this is a vulnerability when an attacker
 may be able to pair your device with an AirPlay
 receiver. The attacker must have physical access to the
 device. But this works even if the device is locked.
 Interesting there are a couple of vulnerabilities that affect
 Bluetooth. That's sort of the majority here of the
 vulnerabilities. And the idea behind these vulnerabilities
 is that these vulnerabilities weaken the handshake procedure
 with Bluetooth. So essentially someone would be able to pair
 a device with your phone or your Mac. There's also some
 rate limiting issues for example here with AirPlay.
 That also you know could make it easier to kind of brute
 force connection with your device. And then we also have
 a vulnerability that sort of leaks sensitive data. And
 probably some of the more interesting vulnerability from
 this set is a vulnerability in iMessage. Where someone may be
 able to actually join an iMessage group. And then
 receive its messages without you actually sort of inviting
 them or adding them to an iMessage group. Not sure if
 they would still show up as a member in that group. Anyway,
 apply the patches. Nothing sort of outrageously dangerous
 here or critical. Nothing exploited at least as far as
 Apple states it in their advisory. Well we also have a
 patch day from SAP. Now SAP typically does have a patch
 day in sync with Microsoft. I often don't cover them because
 not too many people are using SAP. But if you're using SAP
 and SAP NetWeaver which is one of the affected products
 here. Well you certainly care about these vulnerabilities.
 And earlier this week I wrote about it. So figured I'll at
 least mention the patch Tuesday for SAP. There are
 four vulnerabilities that have a perfect 10 as their CVSS
 score. And then an additional three with a 9.9. And two more
 in the nines. And so certainly something to pay attention to.
 There is one vulnerability that's broken access control
 in SAP Gateway. Onapsis, a company that does research in
 ERP security, has reported this vulnerability and
 published a blog post about it. They're luckily not going
 into too much detail. So it's not sort of a blueprint for
 exploitation of the vulnerability. But it gives a
 couple of hints. Like for example the proxy's access
 control list. Here is apparently sort of one of the
 culprits in enabling this vulnerability. So that one
 actually sounds like it's once the details are out. Not that
 terribly difficult to exploit. We also have memory corruption
 vulnerabilities. Again Onapsis has details about at least one
 of these vulnerabilities. It affects WebSockets. This one
 is likely a little bit more difficult to exploit. Onapsis
 is only talking about sort of how they exploit it for denial
 of service. But yes, remote code execution is possible via
 that vulnerability. Just of course as many of these memory
 corruption vulnerabilities may not be that easy sort of to
 exploit reliably. So definitely get your SAP
 products updated. And as all of these complex systems of
 course, take also look at which components you are
 actually running in your environment. Well, that's it
 for today. Thanks for listening. Thanks for liking.
 Thanks for subscribing to this podcast. And talk to you again
 tomorrow. Bye.