Microsoft Patch Tuesday for December 2014: Light Month, Some Changes

Summary: Microsoft released its final Update Tuesday of 2014 with seven bulletins covering 24 CVEs, three rated critical and four important. The company dropped its deployment priority rating in favor of an exploitability index from zero to three, and began reporting whether each vulnerability came through coordinated disclosure or was publicly known beforehand.
What's compelling: The new exploitability index puts a zero-to-three number on each flaw, with zero meaning active exploitation - a signal that shifts triage from environment-specific guesswork to a stated exploitation likelihood your patch cadence now has to answer to.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-6319 CVE-2014-6325 CVE-2014-6326 CVE-2014-6328 CVE-2014-6336 CVE-2014-6355 CVE-2014-6356 CVE-2014-6357 CVE-2014-6360 CVE-2014-6361 CVE-2014-6363 CVE-2014-6364 CVE-2014-6365 CVE-2014-6368
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026