Aggiornamenti Mensili Microsoft (AL04/261111/CSIRT-ITA)
Data:
11 Novembre 2026
Impatto Sistemico
Critico (75.0)
Sintesi
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 1095 nuove vulnerabilità, di cui una di tipo 0-day.
Tipologia
- Remote Code Execution
- Elevation of Privilege
- Security Feature Bypass
- Information Disclosure
- Denial of Service
- Spoofing
- Tampering
Descrizione e potenziali impatti
Nel dettaglio, la vulnerabilità sfruttata attivamente riguarda Microsoft Office Outlook ed è identificata tramite la CVE-2026-124194 . Tale vulnerabilità – di tipo “Spoofing” e con score CVSS v3.1 pari a 6.5 – è dovuta alla mancata visualizzazione di un avviso di sicurezza quando Outlook effettua una connessione verso una risorsa di rete controllata da un attaccante. Un utente malintenzionato, tramite l’invio di un file di messaggio opportunamente predisposto e inducendo la vittima ad aprirlo, potrebbe causare la divulgazione dell’hash NTLMv2 dell’utente. Tali informazioni di autenticazione potrebbero successivamente essere utilizzate per attività di impersonificazione dell’utente e per ottenere l’accesso alle risorse aziendali associate all’identità compromessa.
Prodotti e/o versioni affette
- .NET
- ASP.NET Core
- Active Directory Domain Services
- Aspire
- Azure CLI
- Azure Confidential Clean Rooms
- Azure CycleCloud
- Azure DevOps
- Azure DevOps Server
- Azure File Sync
- Azure Front Door (AFD)
- Azure Local
- Azure Managed Grafana
- Azure NFS mount helper (aznfs)
- Azure OpenAI
- Azure Pipelines
- Connected Devices Platform Service (Cdpsvc)
- Data Sharing Service Client
- Desktop Window Manager
- Entra Device Registration
- Graphic Fonts
- HEIF Image Extensions
- HID Parser Library
- JDBC Driver for SQL Server
- Kernel Transaction Manager
- Microsoft ActiveX Installer Service
- Microsoft Authentication Library (MSAL) for Node.js
- Microsoft Azure Kubernetes Service
- Microsoft Bluetooth Driver
- Microsoft Color Management
- Microsoft Defender
- Microsoft Exchange Server
- Microsoft Graph
- Microsoft Input Method Editor (IME)
- Microsoft JScript
- Microsoft MCP Gateway
- Microsoft Office
- Microsoft Office Access
- Microsoft Office Excel
- Microsoft Office Outlook
- Microsoft Office PowerPoint
- Microsoft Office SharePoint
- Microsoft Office Visio
- Microsoft Office Word
- Microsoft QUIC
- Microsoft Teams
- Microsoft Teams for Android
- Microsoft Trace Data Helper
- Microsoft WDAC OLE DB provider for SQL
- Microsoft Windows App Store
- Microsoft Windows Codecs Library
- Microsoft Windows Media Foundation
- Microsoft Windows SCSI Class System File
- Microsoft Windows Search Component
- Microsoft Windows Speech
- Microsoft XPS Document Converter
- Quality Windows Audio/Video Experience (QWAVE) service
- RPC Runtime
- Remote Desktop Client
- Remote Desktop Gateway Service
- Role: DNS Server
- SQL Server
- Servicing Stack Updates
- Software Protection Platform (SPP)
- Virtual Hard Disk (VHD) Miniport Driver
- Visual Studio
- Visual Studio Code
- Windows Active Directory
- Windows Admin Center
- Windows Advanced Rasterization Platform
- Windows Ancillary Function Driver for WinSock
- Windows AppX Deployment Service
- Windows AppX Package Manager
- Windows Audio Service
- Windows Autopilot
- Windows Background Intelligent Transfer Service (BITS)
- Windows Backup Engine
- Windows Bind Filter Driver
- Windows Biometric Service
- Windows Bluetooth A2DP driver
- Windows Bluetooth Port Driver
- Windows Bluetooth Service
- Windows Broadcast DVR User Service
- Windows Brokering File System
- Windows CD-ROM Driver
- Windows CNG Key Isolation Service
- Windows COM
- Windows COM+ Event System Service
- Windows Camera Frame Server Monitor
- Windows Client for NFS
- Windows Clipboard Virtual Channel Extension
- Windows Cloud Files Mini Filter Driver
- Windows Connected User Experiences and Telemetry
- Windows Connection Manager Service
- Windows Container Isolation FS Filter Driver (unionfs.sys)
- Windows Cred SSProvider Protocol
- Windows Credential Manager
- Windows Credential User Interface
- Windows DHCP Client
- Windows DHCP Server
- Windows DIAL Client
- Windows DNS
- Windows DWM Core Library
- Windows Defender Firewall Service
- Windows Deployment Services
- Windows Device Association Service
- Windows Device Inventory
- Windows Diagnostic Policy Service
- Windows DirectX
- Windows Distributed File System (DFS)
- Windows Distributed Transaction Coordinator
- Windows Encrypting File System (EFS)
- Windows Error Reporting
- Windows Event Collector Service
- Windows Event Logging Service
- Windows FTP Service
- Windows Fast FAT Driver
- Windows Feedback Hub
- Windows File Server Resource Management Service
- Windows Filter Manager
- Windows Filtering Platform (WFP)
- Windows Function Discovery Resource Publication
- Windows Function Discovery SSDP Provider
- Windows GDI
- Windows Graphics Kernel
- Windows HTTP.sys
- Windows Hyper-V
- Windows IKE Extension
- Windows Image Acquisition
- Windows Imaging Component
- Windows Input System
- Windows Installer
- Windows Internet Connection Sharing (ICS)
- Windows Internet Information Services
- Windows Kerberos
- Windows Kernel
- Windows Kernel-Mode Drivers
- Windows LDAP – Lightweight Directory Access Protocol
- Windows LUAFV
- Windows Link Layer Topology Discovery Protocol
- Windows Local Security Authority Subsystem Service (LSASS)
- Windows Local Session Manager (LSM)
- Windows MIDI Service Module
- Windows Management Instrumentation
- Windows Maps
- Windows Media Player
- Windows Message Queuing
- Windows Message Queuing Queue Manager
- Windows Microsoft Account Sign-in Assistant
- Windows Microsoft DirectMusic
- Windows Mobile Device Management
- Windows Modern Device Management (MDM)
- Windows Multiple Provider Router
- Windows NTFS
- Windows NTLM
- Windows NetBIOS
- Windows Network Address Translation (NAT)
- Windows Network Connected Devices Auto-Setup Service
- Windows Network Connection Broker
- Windows ODBC Driver
- Windows OLE
- Windows OLE DB
- Windows Overlay Filter
- Windows Performance Counters
- Windows Performance Monitor
- Windows Phone Service
- Windows Point-to-Point Protocol over Ethernet (PPPoE)
- Windows PowerShell
- Windows Print Spooler Components
- Windows PrintWorkflowUserSvc
- Windows Program Compatibility Assistant Service
- Windows Projected File System
- Windows Projected File System Filter Driver
- Windows Push Notification Core
- Windows Push Notifications
- Windows Raw Image Extension
- Windows Redirected Drive Buffering
- Windows Remote Access API
- Windows Remote Access Connection Manager
- Windows Remote Assistance
- Windows Remote Desktop
- Windows Remote Desktop Services
- Windows Remote Procedure Call Runtime
- Windows Resilient File System (ReFS)
- Windows Rich Text Edit Control
- Windows SMB
- Windows SMB Client
- Windows SMB Server
- Windows SMB Server Network Transport Driver (srvnet.sys)
- Windows Sandbox
- Windows Schannel
- Windows Secure Socket Tunneling Protocol (SSTP)
- Windows Security Account Manager
- Windows Security Center
- Windows Sensor Data Service
- Windows Setup and Deployment
- Windows Shell
- Windows Smart Card
- Windows Storage
- Windows Storage Spaces Controller
- Windows Subsystem for Linux
- Windows TCP/IP
- Windows TPM
- Windows Task Scheduler
- Windows Telephony Service
- Windows Text Services Framework
- Windows USB Driver
- Windows USB Hub Driver
- Windows USB Scanner Driver
- Windows USB Video Driver
- Windows USM Communication Manager
- Windows Universal Disk Format File System Driver (UDFS)
- Windows User Manager Service
- Windows VMSwitch
- Windows Virtual Filtering Platform (VFP)
- Windows Volume Shadow Copy
- Windows Win32K
- Windows Wireless Networking
- Windows XWizard Framework
- Windows Xbox Live Networking Service
- Windows eSCL Scanner
- Windows exFAT File System
- Windows iSCSI
- Windows iSCSI Target Service
- Winlogon
- Winsock
- Xbox
- vhdmp.sys
Azioni di mitigazione
In linea con le dichiarazioni del vendor, si raccomanda di procedere all’aggiornamento dei prodotti impattati attraverso l’apposita funzione di Windows Update.
Di seguito sono riportate le sole CVE associate a vulnerabilità classificate con gravità “critica” e “alta”, nonché quelle per le quali risultano evidenze di sfruttamento attivo in rete:
Riferimenti
- https://msrc.microsoft.com/update-guide
- https://msrc.microsoft.com/update-guide/releaseNote/2026-nov
CVE
Change log
| Versione | Note | Data |
|---|---|---|
| 1.0 | Pubblicato il 11-11-2026 | 11/11/2026 |
Il presente articolo è un prodotto originale di csirt.gov.it, riproposto qui a solo scopo di aumentarne la visibilità. Può essere visualizzato in versione originale al seguente link
Ultimo aggiornamento
11 Novembre 2026, 12:02
CSIRT Toscana