[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGGTsXJrxDBKT4a9i4iAGRcbbZEBruvgTSynymfn_cNI":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":109},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"963b48a7-18e1-4000-aa9e-891810c8a1d3","Microsoft releases Windows 10 KB5131096 extended security update","microsoft-releases-windows-10-kb5131096-extended-security-update-1aa57e","Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]","Microsoft released Windows 10 KB5131096 extended security update for enterprise LTSC and ESU program users, updating systems to build 19045.7846. The update includes November 2026 Patch Tuesday fixes addressing 1,235 vulnerabilities across Microsoft products, including one actively exploited Outlook zero-day. Additional fixes address DST rules for Cuba, printer configuration issues in Active Directory, Remote Desktop shadow connections, PowerShell script signing validation, and USB Audio Class 1.0 device issues from prior updates.","Microsoft releases Windows 10 KB5131096 extended security update with November 2026 Patch Tuesday fixes.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-releases-windows-10-kb5131096-extended-security-update\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F09\u002F10\u002Fwindows-10-gradient.jpg","2026-11-10T20:04:36+00:00","2026-11-10T21:00:12.941253+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows 10","product",{"name":24,"type":22},"Outlook",{"name":26,"type":22},"Windows Server 2016",{"name":28,"type":22},"Windows Server 2012 R2",{"name":30,"type":22},"PowerShell","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21,26],{"controls":47,"vendors":105},[48,77],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":91,"vendor_name":18,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",[106],{"slug":91,"name":18,"logo_path":92,"roles":107},[108],"affected",{"slug":110,"title":111,"body":112,"framework_refs":113,"framework_notes":119},"actively-exploited-outlook-zero-day-among-1235-vulnerabilities-patched-in-windows-10-extended-securi","Actively Exploited Outlook Zero-Day Among 1,235 Vulnerabilities Patched in Windows 10 Extended Security Update","Microsoft's November 2026 Patch Tuesday update addressed 1,235 vulnerabilities across its product portfolio, including an actively exploited zero-day in Outlook — underscoring how quickly threat actors move to weaponize unpatched flaws. Organizations running Windows 10 in enterprise LTSC or ESU environments face elevated risk because these systems are often legacy deployments where patching cadence may lag. The sheer volume of vulnerabilities patched in a single cycle highlights the persistent challenge of keeping complex software ecosystems secure. Failing to apply this update promptly — especially given the confirmed in-the-wild exploitation — leaves email infrastructure and endpoints exposed to real, active threats.",[114,115,116,117,118],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly Identified Vulnerabilities are Mitigated or Documented as Accepted Risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities",{"NIS2 Article 21(2)(e)":120,"NIST SP 800-53 SI-2: Flaw Remediation":121,"CIS Control 7: Continuous Vulnerability Management (v8)":122,"ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities":123,"NIST CSF 2.0 RS.MI-3: Newly Identified Vulnerabilities are Mitigated or Documented as Accepted Risks":124},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in acquisition and maintenance — organizations under NIS2 are obligated to have processes ensuring timely patching of vulnerabilities like those addressed in this update.","SI-2 requires organizations to identify, report, and correct information system flaws, and to install security-relevant updates within defined time periods — directly applicable to deploying this Patch Tuesday release.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities — applying this update promptly for the actively exploited Outlook zero-day is exactly the prioritized remediation process this control mandates.","A.8.8 requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly covering the obligation to assess and apply this cumulative security update.","This category requires that once an actively exploited vulnerability like the Outlook zero-day is identified, organizations either mitigate it promptly or formally accept and document the risk."]