CVE-2021-42321 & CVE-2021-42292

On November 9, 2021 Microsoft released security updates addressing two actively exploited vulnerabilities: CVE-2021-42292 (Microsoft Excel security feature bypass that can allow local code execution via a crafted file) and CVE-2021-42321 (post-authentication remote code execution in on-premises Microsoft Exchange Server 2016 and 2019). Microsoft reports limited exploitation, has provided detection guidance (including a PowerShell query for Exchange), and Arctic Wolf recommends reviewing affected versions and applying patches as soon as possible.