Microsoft today said it will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer (IE), Windows, Office, Exchange Server and SharePoint Server.
The 16 "bulletins," as Microsoft calls its updates, listed in today's advance notice were nearly double the previous 2014 record of nine set in May and August, trumped 2013's record of 13, and came within an ace of the all-time 17 last set in April 2011.
Russ Ernst, director of product management with security firm Lumension, called November's slate "whopping" in an email today, while Jon Rudolph, senior software engineer at Core Security, christened it "overwhelming."
Five of the 16 were pegged "critical," Microsoft's most serious threat ranking. Nine were tagged "important," the next step down in the four-step scoring system, while two were labeled "moderate."
A quintet were identified as fixing vulnerabilities that, if exploited, could result in "remote code execution," meaning that successful hackers could hijack a system and install malware on the machine. Seven others will patch less dire "elevation of privilege" bugs.
As is now rote, Microsoft will patch all supported versions of its IE browser, from the almost-retired IE6 on Windows Server 2003 to the newest IE11. The fix for IE on Windows' client editions -- Vista, Windows 7 and Windows 8/8.1 -- was ranked critical for IE7, IE8, IE9, IE10 and IE11.
Microsoft did not put a number to the individual IE vulnerabilities it will patch, but in the last five months the company has quashed 161 bugs in the browser, or an average of 32 each month. The largest number of IE flaws fixed in a single month during that stretch was 60 in June, but September (with 37) and August (26) weren't far behind.
Other critical updates will tackle vulnerabilities in various flavors of Windows, including the intriguing Bulletin 5, which affects only the server operating systems. Microsoft said that the one or more bugs set for quashing by Bulletin 5 were not present in the client editions, but that they would be updated nonetheless to provide "additional defense-in-depth hardening" as protection against similar vulnerabilities that may pop up in the future.
A pair of the important updates will address vulnerabilities in SharePoint Server 2010 and Exchange Server 2007, 2010 and 2013. Fixes applied by those updates will deal with elevation of privilege flaws, and may require restarting the servers, often a dicey deal for IT staffs as both SharePoint and Exchange -- but especially the latter -- are mission-critical systems that cannot be offline for any but the very shortest stretches.
"Exchange server patching is always tricky because the systems are mission critical and often deployed on the perimeter," agreed Ross Barrett, senior manager of security engineering at Rapid7, in an email. "Administrators will have to balance the risk of exploit with their perceived exposure and their tolerance for downtime."
Microsoft will release the 16 updates on Nov. 11 around 10 a.m. PT (1 p.m. ET).