8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.908 High
EPSS
Percentile
98.8%
NEW 11/9/2021 IMPORTANT Because of minimal operations during the holidays and the upcoming Western new year, there won’t be a preview release (known as a “C” release) for the month of December 2021. There will be a monthly security release (known as a “B” release) for December 2021. Normal monthly servicing for both B and C releases will resume in January 2022.
11/19/20
For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows 10, version 1607, see its update history page.
This security update includes quality improvements. Key changes include:
__
Clip or tap to view the known issues
Symptom | Workaround |
---|---|
After installing this update, Windows print clients might encounter the following errors when connecting to a remote printer shared on a Windows print server: |
0x000006e4 (RPC_S_CANNOT_SUPPORT)
0x0000007c (ERROR_INVALID_LEVEL)
0x00000709 (ERROR_INVALID_PRINTER_NAME)
Note The printer connection issues described in this issue are specific to print servers and are not commonly observed in devices designed for home use. Printing environments affected by this issue are more commonly found in enterprises and organizations.| This issue is resolved in KB5008207.
After installing the November security updates, released November 9, 2021 on your Domain Controllers (DC) that are running a version of Windows Server, you might have authentication failures on servers relating to Kerberos Tickets acquired via S4u2self. The authentication failures are a result of Kerberos Tickets acquired via S4u2self and used as evidence tickets for protocol transition to delegate to backend services which fail signature validation. Kerberos authentication will fail on Kerberos delegation scenarios that rely on the front-end service to retrieve a Kerberos ticket on behalf of a user to access a backend service. Important Kerberos delegation scenarios where a Kerberos client provides the front-end service with an evidence ticket are not impacted. Pure Azure Active Directory environments are not impacted by this issue. End users in your environment might be unable to sign into services or applications using Single Sign On (SSO) using Active Directory on-premises or in a hybrid Azure Active Directory environment. Updates installed on the client Windows devices will not cause or affect this issue.Affected environments might be using the following:
Azure Active Directory (AAD) Application Proxy Integrated Windows Authentication (IWA) using Kerberos Constrained Delegation (KCD)
Web Application Proxy (WAP) Integrated Windows Authentication (IWA) Single Sign On (SSO)
Active Directory Federated Services (ADFS)
Microsoft SQL Server
Internet Information Services (IIS) using Integrated Windows Authentication (IWA)
Intermediate devices including Load Balancers performing delegated authentication
You might receive one or more of the following errors when encountering this issue:
Event Viewer might show Microsoft-Windows-Kerberos-Key-Distribution-Center event 18 logged in the System event log
Error 0x8009030c with text Web Application Proxy encountered an unexpected is logged in the Azure AD Application Proxy event log in Microsoft-AAD Application Proxy Connector event 12027
Network traces contain the following signature similar to the following:
The KMS client could not reach the KMS host.
The KMS host did not respond.
The client did not receive the response.
For more information on these event IDs, see Useful KMS client events - Event ID 12288 and Event ID 12289.| This issue is resolved in KB5010359.
KB5007192 is no longer available.
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.908 High
EPSS
Percentile
98.8%