Microsoft to release Windows security fix today

Larry Seltzer
Updated
A privilege escalation bug being exploited in the wild could turn a normal user into a domain administrator.

Microsoft has announced that they will releasing today an out-of-band update to address a privilege escalation bug in all server versions of Windows. The update will be released at approximately 10 a.m. PST.

Update on November 18: An earlier version of this story stated that all versions of Windows, including desktop versions, were vulnerable. Only server versions are vulnerable, but both server and desktop versions will receive "additional defense-in-depth hardening that does not fix any known vulnerability."

The update will be designated MS14-068, one of two updates held back one week ago on Patch Tuesday.

The updates had been listed in the Advance Notification for updates, but not delivered on Tuesday. At the time all the bulletins said was "Release date to be determined."

There is no word yet on the disposition of MS14-075, the other update withheld on Patch Tuesday. That update will address unspecified problems in Exchange Server.

In the case of MS14-075 Microsoft said that a problem with the Installer program was responsible for the delay. They have not said what held back the MS14-068 update for Windows.