🔍 Read the full analysis: Microsoft Addresses 1,094 Security Flaws; One Is Under Attack And Paint Gets A Fix on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company says was exploited before a fix. CISA added that flaw to its exploited-vulnerabilities list on November 10. A separate Paint vulnerability has a reported fix, but some users may not yet have received the working version.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company marks as exploited before a fix was available. The flaw, CVE-2026-124194, can expose a user’s NTLMv2 password hash when a crafted file is opened, according to Microsoft’s description; CISA added it to its exploited-vulnerabilities list the same day. Separately, a reported fix for a Paint vulnerability may not yet be available to every user.
Microsoft’s Security Update Guide describes the release as consisting of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 vulnerabilities published on November 10, with the difference attributed to CVE-2026-109469, an Entra Device Registration flaw published November 5. Microsoft says that Critical flaw requires no customer action. The count refers to Microsoft’s own vulnerabilities, not the third-party entries also present in its machine-readable data.
The Outlook issue is rated Moderate, with a CVSS score of 6.5, rather than Critical. Microsoft marks it “Exploitation Detected.” The source account says a crafted file can cause an NTLMv2 password hash to be leaked when opened. CISA added the vulnerability to its list of exploited flaws on November 10. Those facts make the Outlook fix a priority even though its severity rating is below that of some other issues in the release.
The release also includes 726 Windows and 174 Office CVEs, according to Microsoft’s product-family breakdown, as well as fixes for SQL Server, developer tools, SharePoint, Azure, Exchange and Defender. A separate Paint issue, CVE-2026-83844, was published October 13. Heise reported that the version Microsoft initially identified as fixed remained vulnerable. A working version, 11.2609.401.0, was named November 6, while PC Gamer reported that some users still could not see it.
November security release Outlook exploit and Paint fix
Microsoft lists 1,094 CVEs. One Outlook flaw was exploited before a fix, while some users may still be missing the reported Paint repair.
Prioritize the exploited Outlook flaw
CVE-2026-124194 is rated Moderate, but Microsoft marks it as exploited.
Apply the relevant updates and check Microsoft’s advisory for affected products and conditions.
The described exposure is an NTLMv2 password hash leak when a crafted file is opened.
CISA added the flaw to its exploited-vulnerabilities list on November 10.
Check the Paint version
A reported repair may not have reached every user.
- Version 11.2609.401.0 was named November 6.
- Check the Microsoft Store for the update.
- Some users reportedly could not see it.
- Confirm the installed version is 11.2609.401.0 or later identified as fixed.
Put the counts in context
The release total is Microsoft’s own CVEs; differences in publication timing and counting methods affect comparisons.
| Count | What it covers |
|---|---|
| 1,094 | Microsoft’s November release total |
| 1,093 | Krebs on Security count published November 10 |
| 63 | Microsoft CVEs listed in November 2025 |
Prioritize Outlook and Paint Fixes
The exploited Outlook vulnerability gives administrators and users a concrete reason to review this release promptly: Microsoft says exploitation occurred before the fix, and the described exposure involves a credential-related hash. The Moderate rating does not mean the issue can be ignored when active exploitation is reported. CISA’s listing adds a public indicator for organizations tracking known exploited vulnerabilities.
The larger release also creates a practical triage problem. Microsoft lists fixes across operating systems, productivity software, servers and development products, but the total count alone does not show which updates affect a particular network. The source recommends applying Outlook and Office updates first, then reviewing Critical server fixes relevant to each organization’s systems. Paint requires a separate version check because reports indicate the named repair may not yet have reached everyone.
Microsoft’s own account links growing vulnerability counts partly to improved discovery, including AI-assisted research. That context may explain why patch volumes have risen, but the company has not disclosed how many of these November fixes came from AI. The count is a measure of reported vulnerabilities, not by itself a measure of how many are exploitable or how much risk any one user faces.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Raspberry
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in Patch Counts
The November total is far above the figure on Microsoft’s release page a year earlier: 63 CVEs in November 2025, compared with 1,094 in November 2026. The source’s month-by-month review reports 1,474 in October 2026, 999 in September and 663 in July. These counts describe entries in Microsoft’s security data; differences in reporting and counting methods matter when comparing them with other totals.
Microsoft has said vulnerability discovery is changing. In an April post, Tom Gallagher, a vice president of engineering at the Microsoft Security Response Center, wrote that AI can find more issues more quickly across a broader surface area. In May, he said advanced AI models are part of the discovery process and that releases may continue to grow for some time. He also pointed to more mature automation and broader participation by outside researchers, and said the increase was not driven by one model or change.
The November data credits researchers who used an AI model in 24 entries published November 10: 23 cite GLM from z.ai and one cites Claude. The Outlook flaw’s credit line names Benoît Sevens using Claude with Anthropic, alongside a researcher listed as “nono.” Those credits concern the credited research; they do not reveal what tools Microsoft used internally to find vulnerabilities.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 10, 2026
Paint Availability and AI Attribution
The supplied account does not provide the complete technical description of the Outlook attack, the full patch instructions, or the affected product versions. It reports that opening a crafted file can leak an NTLMv2 hash, but readers should consult Microsoft’s advisory for exact conditions and update guidance. The sources provided also do not establish how many November vulnerabilities were found with AI tools overall; researcher credit lines are not a measure of Microsoft’s internal discovery process.
For Paint, the version reported as working is 11.2609.401.0, but PC Gamer’s account says it was still missing for some users. The available information does not specify how many users were affected, how quickly distribution was expected to finish, or whether further updates followed. The difference between Microsoft’s 1,094 release-note count and Krebs on Security’s 1,093 count is explained by the earlier Entra Device Registration publication, according to the source material.
Check Updates and Advisories
Organizations should review Microsoft’s November advisories against the products and versions they operate, apply the Outlook and Office updates, and assess relevant Critical server fixes. The source recommends checking the Paint version separately through the Microsoft Store and confirming that the installed version is 11.2609.401.0 or a later version Microsoft identifies as fixed. Administrators should verify deployment rather than assume an update has reached every device.
Further clarity depends on Microsoft’s advisory details and the availability of the Paint update across affected systems. CISA’s listing records the Outlook flaw as exploited, but the material provided does not report the scale of attacks or disclose how many organizations were affected. Microsoft has also not provided a breakdown of AI’s contribution to the November fixes.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source attributes the difference to an Entra Device Registration flaw published November 5.
Which vulnerability was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is the flaw marked “Exploitation Detected.” Microsoft rates it Moderate, with a CVSS score of 6.5, and CISA added it to its exploited-vulnerabilities list on November 10.
What does the Outlook flaw do?
The supplied account says opening a crafted file can leak a user’s NTLMv2 password hash. It does not include Microsoft’s complete technical description, so affected users and administrators should check the official advisory for exact conditions and remediation.
Is the Paint vulnerability fixed for everyone?
That is not clear from the available reporting. Version 11.2609.401.0 was identified as the working version on November 6, but PC Gamer reported that some users still could not see it. Check the Microsoft Store and Microsoft’s current Paint advisory for the latest status.
Did AI find all or most of the November vulnerabilities?
Microsoft has said AI models are part of its vulnerability-discovery process, but it has not said how many November fixes came from AI. The source reports AI-related researcher credits on 24 entries published November 10; those credits do not show Microsoft’s internal tools or establish an overall share.
Source: ThorstenMeyerAI.com
