🔍 Read the full analysis: Microsoft Fixes 1,094 Flaws: A Patch Tuesday Breakdown, Including Paint on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company says was exploited before a fix became available. The total is far above the 63 CVEs listed for November 2025, but Microsoft has not disclosed how many November fixes were found with AI. A separate Paint vulnerability has a reported fix, though some users may not yet have received the working version.
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company marks as exploited before a fix was available. The count is sharply higher than the 63 CVEs listed for November 2025, while a separate, previously disclosed Paint flaw remains a version-specific update issue for some users.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Security reporter Brian Krebs counted 1,093 flaws first published on November 10; the one-item difference is CVE-2026-109469, a Critical Entra Device Registration flaw published on November 5. Microsoft says that issue requires no customer action. The source analysis says the November total excludes vulnerabilities issued by other vendors that Microsoft also tracks in its data.
The most urgent item identified in the release is CVE-2026-124194, an Outlook spoofing vulnerability. Microsoft rates it Moderate, with a CVSS score of 6.5, and marks it “Exploitation Detected.” The source says a crafted file can expose a user’s NTLMv2 password hash and that the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10. Microsoft’s release is also reported to include fixes across Windows, Office, SQL Server, developer tools, SharePoint Server, Azure and other products.
A separate Paint issue, CVE-2026-83844, was published October 13. German technology publication heise reported that the version Microsoft initially identified as fixed remained vulnerable. The source says Microsoft named version 11.2609.401.0 as the working version on November 6, while PC Gamer reported that some users still could not see that update. These Paint details concern a separate vulnerability and should not be confused with the November release’s 1,094-CVE total.
Patch Tuesday’s sharp rise and the Outlook flaw to prioritize
Microsoft listed 1,094 CVEs in its November 10, 2026 release. For security teams, the reported exploitation of an Outlook flaw is a more immediate signal than the overall count.
Prioritize the exploited Outlook flaw
Microsoft marks CVE-2026-124194 as “Exploitation Detected”; CISA added it to its exploited-vulnerability catalog.
Review Microsoft advisories and confirm applicable updates are installed.
Prioritize vulnerabilities affecting products and systems in your environment.
Check successful installation rather than relying only on deployment status.
A rising monthly count
The November total is far above November 2025, but CVE counts do not measure attacks or equal severity.
What the AI credits show
Researcher acknowledgments offer a partial view, not a full account of how the fixes were found.
- 24 November credit lines explicitly mention AI use.
- 23 name GLM from z.ai; one names Claude.
- Microsoft has not disclosed how many fixes it found using AI.
- Researcher credits do not explain Microsoft’s own tools or AI’s overall contribution.
Check Paint separately
The Paint vulnerability is separate from November’s CVE total and may require a version check.
Prioritize the Exploited Outlook Flaw
The large release count can draw attention, but the reported exploitation status of the Outlook flaw is a more direct signal for immediate risk management. Microsoft’s “Exploitation Detected” label indicates that the flaw had been used in attacks, according to the release information summarized by the source. CISA’s addition of the CVE to its exploited-vulnerability list gives security teams another reason to check whether affected Outlook installations have been updated.
Organizations should not treat all 1,094 entries as equally urgent. The source recommends addressing Outlook and Office updates first, then reviewing Critical server vulnerabilities against the products and systems in use. That is prioritization guidance, not a substitute for checking Microsoft’s advisory details and an organization’s own exposure. The Paint issue calls for a separate version check because the reported working release may not yet be available to every user.
The year-over-year change also matters to administrators who plan testing and deployment. A much larger list can add work to review and prioritize, but the count alone does not show that attackers have gained access to a corresponding number of newly exploitable weaknesses. The source’s monthly analysis says Microsoft CVEs marked as exploited remained between zero and six per month, with one in November. That is a count of flagged flaws, not a measure of attack volume or overall risk.
Products Worth Considering
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Glare-Free Display, Black
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Apple Watch SE 3 GPS 40mm Smartwatch
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in Microsoft CVE Counts
The November count follows a steep rise in Microsoft’s reported monthly totals. The source’s review of Security Update Guide release notes gives 63 Microsoft CVEs in November 2025, then 65 in December. It lists 220 in June 2026, 663 in July, 999 in September and 1,474 in October, before November’s 1,094. Those figures are counts of CVEs in Microsoft release data, not a count of confirmed attacks, affected customers or vulnerabilities with the same severity.
Microsoft has attributed higher disclosure volumes in part to better vulnerability discovery. In an April post, Tom Gallagher, a vice president of engineering at the Microsoft Security Response Center, said AI “can discover more issues, more quickly, across a broader surface area than previous methods.” In May, he wrote that “Advanced AI models are part of the discovery picture and help to accelerate it,” while also pointing to improved automation and broader participation by outside researchers. Microsoft said it expected releases to remain larger for some time and that it was not changing its threshold for fixing bugs.
The source counted 24 November CVE credit lines that explicitly said a researcher used an AI model: 23 named GLM from z.ai and one named Claude. Those acknowledgments do not reveal what tools Microsoft itself used to find issues, or how much AI contributed to the month’s total. The source also reports 5,523 Microsoft CVEs from January through November 2026 under its counting method; Krebs separately described the year’s total as more than 5,100 security patches, using a different count.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
Microsoft has not said how many of November’s fixes were found using AI, including through its own internal tools. Researcher credit lines identify some AI use but do not establish the tools behind the rest of the findings. The reported 24 AI-related credits therefore should not be treated as a full accounting of AI’s role.
The Paint reports also leave practical details unresolved. The source says version 11.2609.401.0 was identified as working, but some users reportedly had not received it. It does not establish how widely the vulnerable version remained in circulation, when availability would reach all users, or whether every affected installation has since updated. The exact attack details and impact for the Outlook flaw are not fully provided in the source material; readers should consult Microsoft’s advisory for the current technical scope.
Check Updates Against Microsoft Advisories
Administrators should review Microsoft’s November Security Update Guide for the affected products and applicable update packages, giving particular attention to CVE-2026-124194 in Outlook and to server vulnerabilities relevant to their environments. They should confirm that updates were successfully installed rather than relying only on deployment status or the size of the monthly release.
Paint users can check the Microsoft Store for the reported version 11.2609.401.0 and compare their installed version with Microsoft’s current guidance. Microsoft’s release notes and product advisories remain the authoritative sources for any revised instructions. Further information is needed to establish when the Paint update will appear for users who have not received it and whether Microsoft will publish a more detailed account of AI’s contribution to the November findings.
Key Questions
How many CVEs did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 first published that day; the difference is one Entra Device Registration CVE published November 5, for which Microsoft says no customer action is needed.
Which November flaw was reported as exploited?
CVE-2026-124194, an Outlook spoofing vulnerability, is marked “Exploitation Detected” in the source’s account of Microsoft’s release. The source says it can expose a user’s NTLMv2 password hash when a crafted file is opened.
Did AI account for the large number of fixes?
Microsoft has said AI is part of its vulnerability-discovery process, alongside more mature automation and broader outside research. It has not disclosed how many of November’s fixes were found with AI. The source identifies 24 researcher credits that explicitly mention AI use, which does not measure Microsoft’s internal use.
What is the reported fix for the Paint vulnerability?
The source identifies Paint version 11.2609.401.0 as the working version for CVE-2026-83844, citing reporting that Microsoft named it on November 6. It also says some users had not yet received that version, so users should check the Microsoft Store and current Microsoft guidance.
Source: ThorstenMeyerAI.com
