cyber.hendryadrian.com
Security News · securityweek.com

Microsoft Patches 137 Vulnerabilities; Adobe Fixes 52 Across 10 Products

· Original article ↗

Summary

Microsoft patched 137 vulnerabilities, none flagged as exploited in the wild; roughly a dozen were rated more likely to be exploited. Adobe also patched 52 vulnerabilities across 10 products, including critical code-execution flaws.

Key points

  • Microsoft’s updates address 137 vulnerabilities; none were flagged as exploited in the wild.
  • Roughly a dozen Microsoft vulnerabilities were rated as more likely to be exploited.
  • CVE-2026-41103 is a critical privilege-escalation flaw in the Microsoft SSO Plugin for Jira & Confluence.
  • Two Word remote-code-execution flaws, CVE-2026-40364 and CVE-2026-40361, could be triggered by viewing a malicious document in the Preview Pane, according to a Tenable researcher.
  • Microsoft also fixed critical-severity flaws in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.
  • Adobe released patches for 52 vulnerabilities across 10 products, including critical code-execution flaws.

Article Details

Event Type
Microsoft Patch Tuesday security updates, with additional Adobe security patches
Impact
Microsoft patched 137 vulnerabilities across its products; none were flagged as exploited in the wild. Roughly a dozen were rated as more likely to be exploited. The updates include critical and high-severity privilege-escalation and remote-code-execution flaws. Microsoft Word vulnerabilities CVE-2026-40364 and CVE-2026-40361 could be triggered by viewing a malicious document in the Preview Pane, according to Satnam Narang of Tenable. Adobe separately patched 52 vulnerabilities across 10 products, including two critical-severity code-execution flaws.

CVE

CVE-2026-40361Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2019; +5 moreThe company also draws attention to two high-severity remote code execution defects in Microsoft Word (CVE-2026-40364 and CVE-2026-40361, CVSS score of 8.4) that are more likely to be exploited.CVE-2026-40364Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2019; +5 moreThe company also draws attention to two high-severity remote code execution defects in Microsoft Word (CVE-2026-40364 and CVE-2026-40361, CVSS score of 8.4) that are more likely to be exploited.CVE-2026-41103Microsoft · Microsoft Confluence SAML SSO plugin; Microsoft · Microsoft JIRA SAML SSO pluginThe most severe of these is CVE-2026-41103, a critical-severity flaw in the Microsoft SSO Plugin for Jira & Confluence that could lead to elevation of privilege.

People

Satnam NarangTenable senior staff research engineer who commented that the Microsoft Word flaws could be exploited with a malicious document, including by viewing it in the Preview Pane.

Vendors

AdobeAdobe on Tuesday released patches for 52 vulnerabilities across 10 products, including a couple of critical-severity code execution flaws.MicrosoftMicrosoft on Tuesday announced patching 137 vulnerabilities across its products, none of which have been flagged as exploited in the wild.

Products

.NETThe security updates also address high-severity flaws in Copilot, .NET, Azure services, Windows kernel and kernel mode drivers, Win32K, LDAP, SQL Server, Edge, Visual Studio Code, and various Windows components andAzure AI Foundryescalation issues in Windows Remote Desktop, Windows Common Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, and Windows CloudAzure Logic AppsOn Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.Azure SDKOn Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.CopilotThe security updates also address high-severity flaws in Copilot, .NET, Azure services, Windows kernel and kernel mode drivers, Win32K, LDAP, SQL Server, Edge, Visual Studio Code, and various Windows components andDynamics 365 (on-premises)On Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.Edgeflaws in Copilot, .NET, Azure services, Windows kernel and kernel mode drivers, Win32K, LDAP, SQL Server, Edge, Visual Studio Code, and various Windows components and services.Microsoft Hyper-VOn Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.Microsoft SSO Plugin for Jira & ConfluenceThe most severe of these is CVE-2026-41103, a critical-severity flaw in the Microsoft SSO Plugin for Jira & Confluence that could lead to elevation of privilege.Microsoft WordThe company also draws attention to two high-severity remote code execution defects in Microsoft Word (CVE-2026-40364 and CVE-2026-40361, CVSS score of 8.4) that are more likely to be exploited.OfficeMore than two dozen vulnerabilities were resolved in the Office suite.SQL Serverflaws in Copilot, .NET, Azure services, Windows kernel and kernel mode drivers, Win32K, LDAP, SQL Server, Edge, Visual Studio Code, and various Windows components and services.VSCode.NET, Azure services, Windows kernel and kernel mode drivers, Win32K, LDAP, SQL Server, Edge, Visual Studio Code, and various Windows components and services.Windows Ancillary Function Driver for WinSockCommon Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, and Windows Cloud Files Mini Filter Driver are also prone toWindows Cloud Files Mini Filter DriverWindows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, and Windows Cloud Files Mini Filter Driver are also prone to exploitation, Microsoft says.Windows Common Log File System DriverHigh-severity privilege escalation issues in Windows Remote Desktop, Windows Common Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, WindowsWindows DNSOn Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.Windows Kernelprivilege escalation issues in Windows Remote Desktop, Windows Common Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, andWindows NetlogonOn Tuesday, Microsoft also rolled out fixes for critical-severity bugs in Dynamics 365 (on-premises), Azure Logic Apps, Windows DNS, Windows Netlogon, Windows Hyper-V, and Azure SDK.Windows Remote DesktopHigh-severity privilege escalation issues in Windows Remote Desktop, Windows Common Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, WindowsWindows TCP/IPWindows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, and Windows Cloud Files Mini Filter Driver are also prone to exploitation, Microsoft says.Windows Win32kin Windows Remote Desktop, Windows Common Log File System Driver, Windows Kernel, Azure AI Foundry, Windows Win32k, Windows Ancillary Function Driver for WinSock, Windows TCP/IP, and Windows Cloud Files Mini Filter

Related Articles