🔍 Read the full analysis: Microsoft Updates Address 1,094 Flaws, With One Under Attack And Paint Patched on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, and one Outlook vulnerability was exploited before a fix. CISA added the flaw to its exploited-vulnerabilities list on November 10. A separate Paint vulnerability has a reported patch-version problem, while Microsoft has not said how many November fixes were found with AI.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook flaw that was exploited before a fix and was added to the U.S. Cybersecurity and Infrastructure Security Agency’s exploited-vulnerabilities list. The release is far larger than Microsoft’s November 2025 list, while a separate Paint vulnerability remains the subject of reports that its stated fix may not reach all users.
The Outlook issue, CVE-2026-124194, is rated Moderate, with a CVSS score of 6.5, by Microsoft. The company marks it as having exploitation detected. Its description says an unauthenticated attacker could use a specially crafted file to expose a user’s NTLMv2 password hash. CISA added the vulnerability to its catalog of known exploited vulnerabilities on November 10. The supplied reporting does not identify the attackers or describe the scale of exploitation.
Microsoft’s release notes say the update consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093, reflecting a difference in publication dates: one additional flaw, CVE-2026-109469, was published November 5 rather than November 10. Microsoft rates that Entra Device Registration issue Critical and says customer action is not needed. The source’s analysis of Microsoft’s data files says the November 10 entries include Microsoft-issued flaws rather than simply adding other vendors’ vulnerabilities.
The reported product breakdown is led by Windows, with 726 CVEs, followed by Office with 174, SQL Server with 59 and Developer Tools with 53. The list also includes SharePoint Server, Azure, Exchange Server, Defender and other products. Separately, Paint vulnerability CVE-2026-83844 was published October 13. Heise reported that the version Microsoft initially identified as fixed remained vulnerable; Microsoft named version 11.2609.401.0 as the working version on November 6. PC Gamer reported that the version was still not appearing for some users.
November updates address 1,094 flaws with Outlook and Paint concerns
Microsoft reported exploitation of an Outlook flaw before its fix. Separate reports say some Paint users may not yet have the working patched version.
Prioritize the exploited Outlook flaw
Microsoft marked CVE-2026-124194 as exploited; CISA added it to its catalog on November 10.
Microsoft says a crafted file could expose a user’s NTLMv2 password hash.
Consult Microsoft’s Security Update Guide and prioritize remediation for systems in your environment.
Review Critical server flaws against the products and systems your organization operates.
The total needs context
The CVE count describes release entries, not affected customers or a single level of risk.
Paint patch availability is uncertain
Reports say the initially identified fixed version remained vulnerable and some users still could not see the working release.
- Version 11.2609.401.0 was identified as the working version on November 6.
- Some users reportedly still could not see it.
- Check the Microsoft Store for version 11.2609.401.0.
- The supplied reporting gives no confirmed rollout schedule.
AI’s contribution remains unclear
The source identified researcher credit lines, but they do not show Microsoft’s internal discovery methods or account for all fixes.
24 lines mention AI models
Twenty-three mention GLM from z.ai and one mentions Claude.
The total role is unknown
Microsoft has not provided a breakdown of AI’s contribution to the November fixes.
Prioritize the Outlook Exposure
The Outlook flaw merits attention despite its Moderate rating because Microsoft says exploitation was detected before the fix. A vulnerability’s severity score is one part of prioritization; evidence of exploitation is another. Organizations using Outlook should review Microsoft’s applicable update guidance and prioritize remediation according to their exposure and internal procedures.
The release’s size also presents a practical challenge for security teams. A four-digit CVE count does not mean every system is affected or that every flaw carries the same risk. The source recommends addressing Outlook and Office first, then reviewing the Critical server flaws that apply to an organization’s environment. That order is advice from the source, not a Microsoft-mandated sequence.
Paint presents a different issue: users may need to check the Microsoft Store to see whether the intended fixed version is available. The reports do not establish that every user is affected, but they show why release notes and actual software versions can matter as much as a patch announcement.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in CVE Counts
The November total follows a steep rise in Microsoft’s monthly figures. The supplied review of the Security Update Guide lists 63 Microsoft CVEs in November 2025, compared with 1,094 in November 2026. It also reports 220 in June 2026, 663 in July, 999 in September and 1,474 in October. These are counts of CVEs in Microsoft’s release data, not a measure of how many customers were affected or how severe the vulnerabilities were.
Microsoft has said that several factors contribute to larger releases. In an April post, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, wrote that AI can help find more issues across a broader range of software. In May, he said advanced AI models were part of vulnerability discovery, while also citing more mature automation and broader participation by external researchers. Microsoft said it expected releases to remain larger for some time and that it was not changing its bug bar.
The source’s analysis found 24 November 10 CVE credit lines referring to researchers using AI models: 23 mention GLM from z.ai and one mentions Claude. Those credits do not reveal how Microsoft uses tools internally or establish how many of the month’s flaws were discovered with AI. The reported figure is a count of credit lines, not a complete accounting of the role of AI.
“Advanced AI models are part of the discovery picture and help to accelerate it.”
— Microsoft Security Response Center engineering vice president Tom Gallagher, in a May post
Patch Reach and AI Attribution
The source material does not include the complete technical description of the Outlook attack, details on who exploited the flaw, or how many victims were affected. CISA’s listing and Microsoft’s exploitation flag support the reported status, but they do not establish the scope of attacks.
It is also unclear how many of the 1,094 CVEs were found or fixed with AI. The 24 researcher credit lines identified in the source do not account for Microsoft’s internal discovery methods. The source says the precise comparison between the Microsoft release-note total and the count reported by Krebs reflects a CVE published five days earlier, but readers should keep the two counting windows distinct.
For Paint, reports say the initially named fixed version was still vulnerable and that version 11.2609.401.0 was not appearing for some users. The supplied material does not establish how broadly the availability problem affects users or provide an independent confirmation of the status across devices.
Check Updates and Published Versions
Microsoft customers should consult the company’s Security Update Guide for fixes that apply to their products, with particular attention to the exploited Outlook vulnerability and relevant Office updates. Administrators should assess Critical server issues against the products and systems they operate rather than treating the overall CVE count as a single risk rating.
Paint users can check the Microsoft Store for version 11.2609.401.0, the version identified in the supplied reporting as the working release. If the version is unavailable, the material does not give a confirmed rollout schedule. Microsoft has not provided, in the supplied source, a breakdown of AI’s contribution to the November fixes or further details on exploitation of the Outlook issue.
Key Questions
How many vulnerabilities are in Microsoft’s November 2026 release?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the supplied reporting says the one-count difference is a Microsoft flaw published November 5.
Which vulnerability was exploited before the update?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, was marked by Microsoft as having exploitation detected. CISA added it to its known exploited vulnerabilities list on November 10.
What does the Outlook flaw do?
Microsoft’s description, as summarized in the source, says a crafted file could expose a user’s NTLMv2 password hash. The source material does not provide the complete attack description or details about affected victims.
Is the Paint vulnerability fixed?
The supplied reporting identifies version 11.2609.401.0 as the working version, but says PC Gamer reported that it was not appearing for some users. The material does not establish the scope of the availability issue.
Did AI find most of the November vulnerabilities?
That is not established. Microsoft says AI is part of its discovery process, but has not said how many November fixes came from AI. The source identifies 24 researcher credit lines referring to AI models, which does not reveal Microsoft’s internal use of such tools.
Source: ThorstenMeyerAI.com
