Microsoft Patch Tuesday – November 2021

Patch Tuesday is once again upon us. The November 2021 edition of Patch Tuesday brings us 55 fixes, 5 of which are rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the November 2021 Patch Tuesday Audit Report

Microsoft Exchange RCE Exploited

Another security issue in Microsoft Exchange got fixed in this month’s updates. Listed as CVE-2021-42321, the vulnerability has a CVSS 3.1 base score of 8.8. While this vulnerability wasn’t rated as critical by Microsoft. Microsoft did say the following: “We are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication vulnerability in Exchange 2016 and 2019. Our recommendation is to install these updates immediately to protect your environment.“

Aside from the usual Microsoft security page, Microsoft created a specific blog post on their Exchange blog to provide more information about this vulnerability.

Microsoft Defender RCE Fixed

One of the critical fixes included this month is a fix for a Microsoft Defender remote code execution vulnerability. Listed as CVE-2021-42298 and with a CVSS 3.1 base score of 7.8, any version of the Microsoft Malware Protection Engine lower than 1.1.18700.3 is affected. For this specific vulnerability, no installation is required, since, by default, Microsoft updates the Malware Protection Engine automatically.

To be safe, you can still check what your assets’ versions are by navigating to the Virus & threat protection menu in the Windows settings and selecting Settings, and then selecting About. However, for a more admin-friendly version. It is recommended to use a Lansweeper registry key scan along with the registry key report to audit the following registry key:

• Rootkey: HKEY_LOCAL_MACHINE
• Regpath: SOFTWAREMicrosoftWindows DefenderSignature Updates
• Regvalue: EngineVersion

Remote Desktop Client RCE

Another critical update is in the Remote Desktop Client. Listed as CVE-2021-38666 and with a CVSS 3.1 base score of 8.8, this vulnerability can be exploited if an attacker has control of a Remote Desktop Server which can be used to trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.

Run the Patch Tuesday November 2021 Audit Report

To help manage your update progress, we’ve created the Patch Tuesday Audit Report that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see at a glance which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

Patch Tuesday November 2021 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

This field is hidden when viewing the form

EmailType

This field is hidden when viewing the form

IM – Conv Page – Processing

This field is hidden when viewing the form

IM – UTM_Campaign FC – Processing

This field is hidden when viewing the form

IM – UTM_Campaign LC – Processing

This field is hidden when viewing the form

IM – UTM_Content FC – Processing

This field is hidden when viewing the form

IM – UTM_Content LC – Processing

This field is hidden when viewing the form

IM – UTM_Medium FC – Processing

This field is hidden when viewing the form

IM – UTM_Medium LC – Processing

This field is hidden when viewing the form

IM – UTM_Source FC – Processing

This field is hidden when viewing the form

IM – UTM_Source LC – Processing

This field is hidden when viewing the form

IM – UTM_Term FC – Processing

This field is hidden when viewing the form

IM – UTM_Term LC – Processing

This field is hidden when viewing the form

gclid

This field is hidden when viewing the form

msclkid

Name

This field is for validation purposes and should be left unchanged.

Count Me In Submit