Microsoft Patch Tuesday fixes 1,235 flaws, incl. exploited Outlook bug

The Outlook flaw

According to Microsoft, an unauthenticated attacker could send a specially crafted message file and persuade a user to open it in a vulnerable version of Outlook. Opening the file makes Outlook connect to a malicious server controlled by the attackers, without showing the expected security warning. The computer then automatically sends the server an encrypted fingerprint of the user's password, the NTLM hash. Attackers can try to crack it to recover the password, or use it to impersonate the victim.

Tyler Reguly, associate director of security R&D at Fortra, urges everyone to update Outlook as soon as possible.

In total, the update fixes 66 flaws rated critical, 48 of which allow remote code execution. Office is particularly affected, with several critical bugs in Word, Excel and Outlook. In most cases, simply opening a booby-trapped document is enough to trigger the attack.

Pressure on IT teams

Reguly believes Microsoft is cleaning up long-hidden bugs that AI is now surfacing, and expects the numbers to fall once the last of them are resolved. In the meantime, with more than 1,000 flaws a month, testing patches on a few machines before wider rollout has become a huge task that wears out security teams. He advises companies not to panic, to focus on vulnerabilities that are actually exploited, and to harden their systems rather than chase every flaw.

To install the update, open Windows Settings, go to Windows Update and click Check for updates. Windows downloads and installs the fix on its own; a restart completes the process.