This month we got patches for 76 vulnerabilities. According to Microsoft, nine are critical, and two are already being exploited.
The number of bugs in each vulnerability category is listed below:

According to the advisory, an attacker who successfully exploited this vulnerability could access a user’s Net-NTLMv2 hash which could be used as a basis of an NTLM Relay attack against another service to authenticate as the user.- The attacker could exploit this vulnerability by sending a specially crafted email that triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane. The CVSS for this vulnerability is 9.8.
In a private threat analytics report seen by BleepingComputer, Microsoft says that this Outlook vulnerability was exploited by STRONTIUM, a state-sponsored Russian hacking group.
CVE-2023-24880

According to the advisory, an attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. The CVSS for this vulnerability is 5.4. This vulnerability was discovered by Google’s Threat Analysis Group, which spotted it being exploited by the Magniber ransomware operation. Another Critical Vuln Worth MentioningAnother critical vulnerability worth mentioning is Remote Code Execution (RCE) affecting HTTP Protocol Stack (CVE-2023-23392). A prerequisite for a server to be vulnerable is that the binding has HTTP/3 enabled and the server uses buffered I/O. HTTP/3 support for services is a new feature of Windows Server 2022. This vulnerability requires no user interaction, no privileges, and low attack complexity. The CVSS for this vulnerability is 9.8.