Microsoft has yet to release a fix for an Internet Explorer browser vulnerability.

Nearly two weeks after Microsoft issued an advisory about a security problem with its Internet Explorer web browser, the software giant still hasn’t released a patch to fix it, leaving millions of users vulnerable to hackers, security vendors warned Friday.

The security vulnerability that allows hackers to launch malicious software onto computers through web sites affects all Windows users except those running Windows Server 2003, Microsoft said in its advisory released November 21.

But the software giant has still not issued a patch to fix the issue. Typically, Microsoft issues fixes for holes in its software in the form of monthly patches released on the second Tuesday of every month, called “Patch Tuesday.” Microsoft’s next bundle of security patches is not due until December 13.

“It wouldn't be a surprise if more malware was distributed that took advantage of this vulnerability in Microsoft’s code,” said Graham Cluley, senior technology consultant for security firm Sophos. “Everyone who uses the Net needs to be very careful about what web sites they visit, which email links they click on, and to ensure their defenses are always up to date.”