🔍 Read the full analysis: Microsoft Patch Tuesday: 1,094 Flaws Fixed, One Under Attack, Paint Patched on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, and one Outlook vulnerability was exploited before a fix was issued. A separate Paint flaw has a corrected version, but reports say some users still cannot get it. Microsoft has not disclosed how many November fixes were found with AI tools.
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that the company says was exploited before a fix became available. The update also addresses a separate Paint vulnerability, though reports say the corrected app version is not yet appearing for some users.
Microsoft’s Security Update Guide release notes describe the November update as containing 1,094 Microsoft CVEs. Krebs on Security counted 1,093 flaws published on November 10; the one-count difference is a separate Entra Device Registration flaw, CVE-2026-109469, which Microsoft published November 5 and says requires no customer action. The source report says Microsoft’s November data also includes entries for other vendors, but those are not included in the release-note total.
The Outlook issue, CVE-2026-124194, is rated Moderate by Microsoft, with a CVSS score of 6.5. Microsoft labels it as having “Exploitation Detected.” The report says opening a crafted file can expose a user’s NTLMv2 password hash; the Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited flaws on November 10. The supplied material does not include Microsoft’s full advisory or enough detail to independently describe the attack conditions beyond that account.
The Paint vulnerability, CVE-2026-83844, was published October 13. According to heise, the Paint version Microsoft initially identified as fixed remained vulnerable. The corrected version, 11.2609.401.0, was identified November 6, while PC Gamer reports that it has not appeared for some users. Microsoft has not provided further details in the supplied material about the scope of that availability issue.
Microsoft Patch Tuesday Outlook, Paint and 1,094 CVEs
Microsoft’s November update includes an Outlook flaw marked as exploited and a Paint fix that may not yet be available to every user.
The flaws to prioritize
The overall count does not show how many flaws are under attack or how severe each one is.
CVE-2026-124194
Rated Moderate, this vulnerability was marked “Exploitation Detected.” The report says opening a crafted file can expose an NTLMv2 password hash.
Check the installed version
Corrected version 11.2609.401.0 was identified November 6, but reports say it is not appearing for some users.
November count, two scopes
The one-CVE difference comes from an Entra Device Registration flaw published earlier.
| Count | What it covers |
|---|---|
| 1,094 | Microsoft’s November release-note total |
| 1,093 | Flaws counted as published November 10 |
| 1 | Separate Entra flaw published November 5; no customer action required |
A rising monthly tally
These are listed vulnerability counts, not measures of exploitation or individual risk.
What organizations and users can do
Identify applicable updates for Outlook, Office and your own systems.
Look for version 11.2609.401.0 in the Microsoft Store and verify the installed version.
The 24 AI-related credits do not show how many fixes Microsoft discovered using AI.
Prioritize Outlook and Paint Updates
The most immediate concern is the Outlook flaw already used in attacks, despite its Moderate rating. That rating describes Microsoft’s assessment of severity; it does not mean the issue is theoretical. Organizations using Outlook should review Microsoft’s advisory and apply the relevant update, while following their normal procedures for checking whether systems are affected.
The scale of the release also complicates patch planning. The source report says the November total is far above the 63 Microsoft CVEs listed in November 2025, while Microsoft’s own guidance has said releases may continue to grow. Administrators still need to distinguish vulnerabilities relevant to their software and systems from the overall count. The Paint reports add a practical wrinkle: a patch may be identified without being available to every user through the same channel at the same time.
Popular right now
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
Hisense E6SR Series 55-Inch 4K UHD Hi-QLED Roku Smart TV
LG 77-Inch OLED evo C6 4K Smart TV
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in Monthly CVE Counts
The source report’s review of Microsoft’s monthly release notes describes a steep rise in listed CVEs during 2026: 220 in June, 663 in July, 999 in September, and 1,474 in October, followed by 1,094 in November. It calculates 5,523 Microsoft CVEs from January through November. These are counts of listed vulnerabilities, not a measure of how many have been exploited or how much risk each one poses.
Microsoft has pointed to several possible contributors to larger releases. In April, Microsoft Security Response Center engineering vice president Tom Gallagher wrote that AI can help discover issues across a wider range of software. In May, he said advanced AI models were part of vulnerability discovery, while also citing improved automation and broader participation by outside researchers. Microsoft has said the increase is not driven by a single model or change and expects releases to remain larger for some time.
The source report found AI-related wording in credit lines for 24 of the 1,093 vulnerabilities published November 10: 23 crediting work using GLM from z.ai and one crediting Claude. Such credits do not establish how many issues Microsoft found internally with AI tools, and Microsoft has not provided that figure for this release.
““Advanced AI models are part of the discovery picture and help to accelerate it.””
— Microsoft Security Response Center engineering vice president Tom Gallagher, in a May post
Microsoft has not said how many of November’s fixes were discovered with AI, either internally or through outside research. Public credit lines provide only partial information and do not reveal the tools used across Microsoft’s security process. The figures also use different counting scopes: Microsoft’s release-note total is 1,094, while Krebs on Security counts 1,093 items published on November 10.
It is also unclear from the supplied reports how many Paint users have yet to receive version 11.2609.401.0, what is causing the delay, or when availability will be consistent. The material does not give the number of Outlook attacks, affected organizations, or whether the reported hash exposure led to account compromise. Those details should not be inferred from the fact that exploitation was detected.
Check Microsoft Advisories and Versions
Administrators should consult Microsoft’s November security guidance to identify applicable updates, giving Outlook and Office systems attention and reviewing relevant Critical server fixes against their own deployments. Users should follow Microsoft guidance for the Outlook vulnerability rather than relying on its Moderate label alone.
For Paint, users can check the Microsoft Store for the corrected version 11.2609.401.0 and verify the installed version. Microsoft has not provided a timeline for the reported distribution issue in the supplied material. Further clarification about availability, and any additional information on the exploited Outlook flaw, would help establish the scope of the remaining risks.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 update?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the difference is one Entra Device Registration flaw published five days earlier.
Which November flaw was reported as exploited?
CVE-2026-124194, an Outlook spoofing vulnerability, is the flaw Microsoft marked as having exploitation detected. The source report says it can expose an NTLMv2 password hash when a crafted file is opened.
Does the large CVE count mean all the flaws are being attacked?
No. The source report says the Outlook issue was the one flaw in this release marked “Exploitation Detected.” A vulnerability count does not indicate how many flaws are under attack or how severe each one is.
What is the Paint patch issue?
The corrected Paint version is reported as 11.2609.401.0. Heise reported that an earlier version named as fixed remained vulnerable, and PC Gamer reported that the corrected version was not appearing for some users.
Did AI find most of the November vulnerabilities?
That is not known. Microsoft has said AI is part of its vulnerability-discovery process, but it has not disclosed how many November fixes came from AI. The source report identified AI-related researcher credits on 24 entries, which does not reveal Microsoft’s internal use of AI.
Source: ThorstenMeyerAI.com
