Microsoft Patches 26 Flaws, Warns of Zero-Day Attack
Summary: Microsoft released updates addressing at least 26 security holes across Windows and related software in seven patch bundles, three rated critical, covering Windows, Internet Explorer, Dynamics AX, Microsoft Lync, and the .NET Framework. Microsoft also issued a FixIt workaround for an unpatched XML Core Services flaw that Google discovered and reported was being exploited in targeted attacks via a browse-and-get-owned trigger in Internet Explorer.
What's compelling: The XML Core Services flaw has no official patch yet and is already being used in targeted attacks, so the FixIt tool that disables the vulnerable component is the only mitigation until Microsoft ships a fix.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026