🔍 Read the full analysis: Microsoft Fixes 1,094 Flaws, Including An Attacked Vulnerability And A Paint Bug on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says was exploited before a fix was available. A separate Paint vulnerability has a reported fix, but some users may not yet be receiving the corrected version. Microsoft has not disclosed how many November fixes were found with AI tools.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says attackers exploited before a fix was available. The release matters to organizations and users because the Outlook flaw can expose a user’s NTLMv2 password hash, while a separate Paint vulnerability has a reported fix that may not yet be reaching everyone.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 issues published on November 10; the difference is one Entra Device Registration flaw, CVE-2026-109469, published November 5. Microsoft says that issue is Critical but requires no customer action. The source account says the release notes’ total does not include other vendors’ vulnerabilities that Microsoft republishes.
The most urgent item highlighted in the source is CVE-2026-124194 in Outlook. Microsoft rates it Moderate, with a CVSS score of 6.5, and marks it as having exploitation detected. Microsoft says an unauthenticated attacker could use a specially crafted file to disclose a user’s NTLMv2 password hash. CISA added the vulnerability to its list of exploited flaws on November 10. The available source material does not provide further technical detail about the attacks or how many users were affected.
The Paint issue is separate: CVE-2026-83844 was published October 13. According to the source account, heise reported that the version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, while PC Gamer reported that some users still could not see it. The recommendation in the source is to update Outlook and Office, review relevant Critical server fixes, and check Paint through the Microsoft Store.
November’s patch release brings urgent checks
Microsoft lists 1,094 CVEs, including an exploited Outlook flaw and a separate Paint update whose rollout may be incomplete.
Where the fixes are listed
The release spans product families; each organization needs to check which fixes apply to its systems.
Prioritize the exploited Outlook flaw
CVE-2026-124194 is rated Moderate, and Microsoft marks it as exploited.
Apply the updates relevant to your systems.
Assess applicable Critical vulnerabilities in your environment.
Check Microsoft Store for version 11.2609.401.0.
The Paint rollout remains unclear
Reports say some users could not see the version Microsoft identified as working.
- Paint issue CVE-2026-83844 was published October 13.
- Microsoft named version 11.2609.401.0 on November 6.
- Some users reportedly still could not see the update.
- No date for full availability is provided.
Prioritize Outlook and Paint Updates
The headline CVE count is large, but the immediate risk is not evenly distributed across the release. Microsoft’s exploitation flag and CISA’s listing make the Outlook issue a priority for organizations that use Outlook, especially because the described attack could expose a password hash. That does not establish that every Outlook user is affected or that attackers can directly use any exposed hash; the source material does not detail the conditions or observed impact.
Administrators also need to match the release to their own systems. The source breakdown attributes 726 CVEs to Windows, 174 to Office, 59 to SQL Server, and smaller counts to other product families. Those figures indicate the breadth of the release, not that every item applies to every installation. Teams should identify applicable fixes and prioritize the exploited Outlook flaw alongside Critical server vulnerabilities present in their environments.
The Paint reports point to a different practical concern: a fix being identified does not necessarily mean every user has received it. Users may need to check the Microsoft Store for the stated version, while the available reporting leaves the rollout status unresolved. The issue highlights why patch status should be checked on affected devices rather than inferred from a release note alone.
Popular right now
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
Roborock Robot Vacuum and Mop with LiDAR Navigation and Self-Empty Dock
Samsung 65-Inch Class M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
A Record-Scale Patch Count
The source’s comparison of Microsoft’s release notes shows 63 Microsoft CVEs in November 2025, compared with 1,094 in November 2026. The November 2026 count is about 17 times the year-earlier count, but the source describes a changing monthly series rather than a steady rise: it reports 220 in June 2026, 663 in July, 999 in September, and 1,474 in October. These are counts of listed CVEs, not a measure of how many vulnerabilities attackers exploited or how severe each issue is.
Microsoft has previously attributed larger releases in part to improvements in vulnerability discovery. In a May post, Microsoft Security Response Center engineering vice president Tom Gallagher wrote that advanced AI models are part of the discovery process and that releases are expected to remain larger for some time. He also cited improved automation and broader participation by outside researchers. Microsoft has not said how many of the November fixes were discovered with AI.
The source account says that 24 November entries credited researchers who used an AI model: 23 cited GLM from z.ai and one cited Claude. The exploited Outlook vulnerability’s credit line names Benoît Sevens using Claude with Anthropic, alongside a second researcher listed as “nono.” Those credits concern researcher contributions and do not establish how much Microsoft’s internal tools contributed to finding the month’s flaws.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
Outlook and Paint Details Still Open
The source material does not say how many people or organizations were affected by exploitation of CVE-2026-124194, when the attacks began, or whether the observed activity is ongoing. It also cuts off partway through Microsoft’s description of the attack, leaving the precise conditions for disclosing an NTLMv2 hash unclear. CISA’s listing confirms the flaw was added to its exploited-vulnerability list on November 10, but does not by itself establish the scale of exploitation.
For Paint, the reported version number and reports of missing updates do not establish how broadly the rollout is incomplete or when all users will receive the update. The source does not provide Microsoft’s response to the reports. Microsoft also has not published a count of November fixes attributable to internal AI tools; researcher credit lines do not answer that question.
The 1,094 figure is Microsoft’s release-note count, while Krebs on Security’s 1,093 count covers issues published on November 10. The source explains the one-item difference as the earlier Entra Device Registration CVE. Readers should keep that timing distinction in mind when comparing totals.
Check Patches and Watch Rollout
Organizations should review Microsoft’s November guidance against the software and services they operate, apply the Outlook and Office updates relevant to their systems, and assess Critical server fixes based on their environment. The source specifically urges prioritizing Outlook and Office, then addressing applicable Critical server vulnerabilities. It does not provide a complete list of affected versions or patch identifiers beyond the flaws discussed, so administrators should consult Microsoft’s Security Update Guide for product-specific instructions.
Users concerned about the Paint issue can check Microsoft Store for version 11.2609.401.0, the version the source says Microsoft identified as working on November 6. Microsoft has not supplied, in the material provided, a date for when the update will reach all users. Further clarification on the rollout and on the Outlook flaw’s attack conditions and impact would help establish the remaining risks.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source account says the difference is an Entra Device Registration CVE published November 5.
Which flaw was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is marked by Microsoft as having exploitation detected. CISA added it to its exploited-vulnerability list on November 10. Microsoft says a crafted file could expose a user’s NTLMv2 password hash.
What is the Paint update issue?
The source reports that the version Microsoft first named as fixing CVE-2026-83844 remained vulnerable, according to heise. Microsoft named version 11.2609.401.0 on November 6, but PC Gamer reported that some users still could not see it.
Did AI find all or most of the November vulnerabilities?
That is not known. Microsoft has said AI helps with vulnerability discovery, but it has not disclosed how many November fixes came from AI. Researcher credits mentioning AI do not show the contribution of Microsoft’s internal tools.
Source: ThorstenMeyerAI.com
