By Tyler Reguly, Associate Director, Security R&D at Fortra
Another Patch Tuesday, another 4-digit patch drop from Microsoft. This month, we do see fewer vulnerabilities than we saw last month. I’m not foolish enough to think that this single drop indicates that we’re into the downward trend that I predicted we’ll see in the coming months. Instead, I think that we’re seeing a continuation of the elevated numbers as Microsoft continues to fix long hidden issues that are being surfaced by AI. Soon, however, these numbers will begin to decline as the last of these long-hidden issues are resolved and we only have new bugs to deal with.
For the past few weeks, everyone has been talking about MS Paint and an associated vulnerability (CVE-2026-83844) from the October Patch Tuesday, that is the kind of noise that experienced administrators and security researchers are ignoring, and everyone else should to. It was not an issue that warranted conversation, yet there was plenty of it. Instead, let’s focus on real issues, like actively exploited vulnerabilities. This month, luckily, we only have one of those, CVE-2026-124194, a vulnerability in Outlook that could allow the disclosure of an account’s NTLMv2 hash. Since Microsoft notes that an exploit has been detected, this one is worth talking about… everyone should work to update Outlook as soon as possible.
I don’t know about everyone else, but I’m tired. I can only imagine that if I’m tired, admins and operations teams everywhere are also tired. We must remember perseverance now. It isn’t a question of if vulnerability counts will decrease, it’s a question of when. We just need to hold on a little bit longer – drink that coffee or that energy drink with a sweet treat to keep yourself going. I believe that we will make it through to the other side, if we prioritize updates and focus on what really matters. The noise is coming at us from all sides, and we need to cut through it and figure out what really matters to the business.
This is where CSOs can help their teams by ignoring any noise coming from vendors and any vulnerabilities that are overhyped. When vuln counts started to rise, it was C-level employees who jumped up the fastest and added to the burden their admins were facing. Now it’s time to settle down and support your teams rather than increasing their burden. Keep these four things in mind:
- AI companies and security vendors may needlessly hype unimportant vulnerabilities because it is a cheap, effective marketing for their services.
- A vulnerability isn’t critical if you don’t have the impacted software deployed.
- Prevention is key, focus your efforts on system hardening and mitigation, it will be more effective than chasing vulnerabilities.
- Prioritization matters. If you’ve developed a prioritization strategy that works for you, don’t change your process just because the media is looking for clicks.
Related
This entry was posted on November 10, 2026 at 3:35 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
November Patch Tuesday Commentary From Fortra
By Tyler Reguly, Associate Director, Security R&D at Fortra
Another Patch Tuesday, another 4-digit patch drop from Microsoft. This month, we do see fewer vulnerabilities than we saw last month. I’m not foolish enough to think that this single drop indicates that we’re into the downward trend that I predicted we’ll see in the coming months. Instead, I think that we’re seeing a continuation of the elevated numbers as Microsoft continues to fix long hidden issues that are being surfaced by AI. Soon, however, these numbers will begin to decline as the last of these long-hidden issues are resolved and we only have new bugs to deal with.
For the past few weeks, everyone has been talking about MS Paint and an associated vulnerability (CVE-2026-83844) from the October Patch Tuesday, that is the kind of noise that experienced administrators and security researchers are ignoring, and everyone else should to. It was not an issue that warranted conversation, yet there was plenty of it. Instead, let’s focus on real issues, like actively exploited vulnerabilities. This month, luckily, we only have one of those, CVE-2026-124194, a vulnerability in Outlook that could allow the disclosure of an account’s NTLMv2 hash. Since Microsoft notes that an exploit has been detected, this one is worth talking about… everyone should work to update Outlook as soon as possible.
I don’t know about everyone else, but I’m tired. I can only imagine that if I’m tired, admins and operations teams everywhere are also tired. We must remember perseverance now. It isn’t a question of if vulnerability counts will decrease, it’s a question of when. We just need to hold on a little bit longer – drink that coffee or that energy drink with a sweet treat to keep yourself going. I believe that we will make it through to the other side, if we prioritize updates and focus on what really matters. The noise is coming at us from all sides, and we need to cut through it and figure out what really matters to the business.
This is where CSOs can help their teams by ignoring any noise coming from vendors and any vulnerabilities that are overhyped. When vuln counts started to rise, it was C-level employees who jumped up the fastest and added to the burden their admins were facing. Now it’s time to settle down and support your teams rather than increasing their burden. Keep these four things in mind:
Share this:
Like this:
Related
This entry was posted on November 10, 2026 at 3:35 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.