🔍 Read the full analysis: Microsoft Fixes 1,094 Flaws This Patch Tuesday: One Is Under Attack, And Paint Needs Its Own Fix on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company says was exploited before a fix became available. CISA added that vulnerability to its exploited-flaws catalog on November 10. A separate Paint fix has also drawn questions because the first version Microsoft identified as fixed was reportedly still vulnerable.
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company marks as exploited before a fix was available. The vulnerability, CVE-2026-124194, could expose a user’s NTLMv2 password hash when a crafted file is opened, according to Microsoft’s description; CISA added it to its exploited-flaws list on November 10.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 flaws published on November 10. The difference is CVE-2026-109469, a Critical Entra Device Registration flaw published five days earlier; Microsoft says no customer action is needed for it. The source’s count excludes vulnerabilities issued by other vendors that Microsoft republishes in its data.
The Outlook vulnerability is rated Moderate, with a CVSS score of 6.5, rather than Critical. Microsoft marks it “Exploitation Detected.” The supplied account says an unauthenticated attacker could send a specially crafted file and that opening it could disclose an NTLMv2 password hash. CISA added the CVE to its catalog of exploited vulnerabilities on November 10. The source recommends prioritizing Outlook and Office updates, then reviewing relevant Critical server fixes.
A separate Microsoft Paint vulnerability, CVE-2026-83844, remains a concern. It was published October 13. The source, citing heise, says the version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, but PC Gamer reported that the update was not appearing for some users. The supplied material does not give the Paint flaw’s severity or explain its specific impact.
November Patch TuesdayOutlook exploited, Paint update in question
Microsoft listed 1,094 CVEs in its November 10 release. One Outlook flaw was exploited before a fix was available, while reports raised questions about Paint’s fix.
The urgent patch priority
Microsoft marked the Outlook vulnerability as exploited, and CISA added it to its catalog on November 10.
CVE-2026-124194 could expose an NTLMv2 password hash when a crafted file is opened.
Match Critical fixes to the products in your environment.
A large release, with context
Monthly release counts cover listed CVEs; they do not measure active exploitation.
Check Paint separately
Reports say the initially identified fixed version remained vulnerable and the update was not appearing for some users.
- Version 11.2609.401.0 was identified as the working version on November 6.
- Check the Microsoft Store for the Paint update.
- How widely the corrected version is available.
- Which users remain affected and the flaw’s specific impact.
AI credits have limits
Researcher credits point to AI use in some entries, but do not reveal Microsoft’s internal discovery methods.
| Figure | What it tells readers |
|---|---|
| 24 entries | Credited researchers with using an AI model |
| Not established | How many CVEs Microsoft found using its own AI tools |
Prioritize the Exploited Outlook Fix
The immediate security priority is not determined by severity rating alone. Microsoft’s “Exploitation Detected” label and CISA’s listing make CVE-2026-124194 a timely patching concern for people and organizations using Outlook, even though its rating is Moderate. The reported risk involves exposure of a password hash, not a confirmed disclosure in every case or proof that a particular user’s account was compromised.
The scale of the release also affects how administrators plan testing and deployment. Microsoft lists fixes across Windows, Office, SQL Server and developer tools, among other product families. Organizations will need to match patches to products in their own environments rather than treat the headline count as a single uniform risk. The unresolved Paint version issue adds a separate reason to verify that an update has reached affected devices instead of assuming that an announced fix is installed.
Products Worth Considering
LG UltraGear 32-inch Curved QHD Gaming Monitor (2560×1440, 180Hz, 1ms, 1000R, HDR10)
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Anker SOLIX C1000 Gen 2 Portable Power Station with 200W Solar Panel
As an affiliate, we earn on qualifying purchases.
A Rapid Rise in Monthly CVE Counts
The November release is far larger than the same month’s release a year earlier. Microsoft’s release notes listed 63 Microsoft CVEs in November 2025, compared with 1,094 in November 2026. The supplied source reports 1,474 in October 2026 and 999 in September. These figures describe CVEs listed in the respective monthly releases; they do not, by themselves, show that the number of actively exploited flaws rose at the same rate.
Microsoft has attributed part of the larger volume to changes in vulnerability discovery. In an April post, MSRC Vice President of Engineering Tom Gallagher wrote that AI “can discover more issues, more quickly, across a broader surface area than previous methods.” In May, he said advanced AI models were “part of the discovery picture,” while also citing improved automation and broader participation by external researchers. Microsoft has said it expects releases to remain larger for some time and that it is not changing its standard for what qualifies as a security bug.
The source counted one flaw marked exploited in November and says monthly totals marked “Exploited: Yes” ranged from zero to six in the data it reviewed. It also found that 24 November entries credited researchers with using an AI model. Those credits do not establish how many vulnerabilities Microsoft found with its own internal AI tools.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
The supplied information does not establish how many of the 1,094 November CVEs Microsoft discovered with AI. Researcher credit lines identify AI use in 24 entries, but do not reveal Microsoft’s internal tools or methods, so they cannot be treated as a complete measure of AI’s contribution.
It is also unclear from the supplied reports how widely the corrected Paint version is available, which users remain affected, or whether Microsoft has published a further status update. The material does not provide the full technical details of the Outlook attack, the number of confirmed victims, or evidence that hash exposure led to account access. CISA’s listing indicates exploitation, but the scale and consequences of those attacks are not specified.
Verify Updates on Affected Devices
Microsoft customers should check that the Outlook and Office security updates have been installed, then review the release notes for Windows and any relevant server products in their environment. Administrators can use Microsoft’s Security Update Guide to identify applicable fixes and plan deployment according to their systems and testing requirements. The source advises checking Paint separately through the Microsoft Store and confirming that the installed version is 11.2609.401.0 or a later version Microsoft identifies as fixed.
Further clarification from Microsoft about Paint availability, the initial version’s status and the reach of the Outlook exploitation would help establish how many users remain exposed. Microsoft’s later release notes and CISA’s catalog may also provide updated information. Until then, the confirmed points are the release count, Microsoft’s exploited designation for the Outlook CVE and reports of uneven availability for the Paint update.
Key Questions
What did Microsoft release on November 10, 2026?
Microsoft’s November Patch Tuesday release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the one-item difference is a Critical Entra Device Registration flaw published November 5.
Which November flaw was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is marked “Exploitation Detected” by Microsoft. The supplied material says opening a crafted file could expose an NTLMv2 password hash. CISA added the flaw to its exploited-vulnerabilities catalog on November 10.
Why is the Outlook flaw a priority if it is rated Moderate?
Its Moderate rating and 6.5 CVSS score do not erase the significance of Microsoft’s exploited designation. The report says the vulnerability was used before a fix was available, so users should check that the relevant Outlook and Office updates are installed.
What is the issue with the Paint update?
The source says the version first named as fixed for CVE-2026-83844 remained vulnerable, according to heise. Microsoft named version 11.2609.401.0 on November 6, but PC Gamer reported that it was not appearing for some users.
Does the release show that AI found most of the vulnerabilities?
No. Microsoft has said AI is part of its vulnerability-discovery process, but it has not stated how many November fixes came from AI. Researcher credits mentioning AI cover only some entries and do not show the tools Microsoft used internally.
Source: ThorstenMeyerAI.com
