Microsoft Plugs Office Holes, But No IE Fix Yet
Summary: Microsoft released three bundles of updates fixing at least 11 security vulnerabilities, mainly in Office products, with only one patch earning a critical rating. The company did not release a fix for a zero-day Internet Explorer flaw now bundled into the Eleonore Exploit pack, a commercial crimeware kit that turns legitimate websites into malware delivery platforms.
Key Takeaway: Symantec's Joshua Talbot notes that for the critical Office flaw, a user need not open a malicious email at all - merely having it appear in Outlook's Reading Pane infects the machine, meaning preview alone is enough to compromise a host.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026