🔍 Read the full analysis: Microsoft Fixes 1,094 Flaws This Patch Tuesday; One Is Under Attack on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, and one Outlook vulnerability was exploited before a fix became available. CISA added that flaw to its exploited-vulnerabilities list on November 10. Microsoft has not said how many flaws in the release were found with AI tools.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that the company marks as exploited before a fix was available. The flaw, CVE-2026-124194, can expose a user’s NTLMv2 password hash when a crafted file is opened, according to the supplied report; CISA added it to its exploited-vulnerabilities list the same day.
Microsoft rates the Outlook issue as Moderate, with a CVSS score of 6.5, rather than Critical. Its release data marks the vulnerability “Exploitation Detected.” The report says an attacker can use a specially crafted file to prompt the exposure of an NTLMv2 password hash. The available material does not establish how many people or organizations were affected, or identify the attackers.
The headline total comes from Microsoft’s Security Update Guide release notes. Krebs on Security reported 1,093 fixes published on November 10; the one-item difference is CVE-2026-109469, a Critical Entra Device Registration flaw published on November 5. Microsoft says no customer action is needed for that issue. The supplied analysis says the November data file includes entries from other vendors as well, but Microsoft’s release-note total counts its own CVEs.
Microsoft’s product-family breakdown lists 726 Windows CVEs and 174 Office CVEs, followed by 59 for SQL Server, 53 for Developer Tools, 27 for SharePoint Server, 25 in Other, 20 for Azure, nine for Exchange Server and one for Defender. The report also flags a separate Paint issue, CVE-2026-83844: Microsoft named a version as fixed, but heise reported that version remained vulnerable. The working version cited in the source is 11.2609.401.0, and PC Gamer reported that some users still could not see it.
Microsoft’s November Patch Tuesday One Outlook flaw was under attack
Microsoft listed 1,094 CVEs in its November 10, 2026 release. One Outlook vulnerability was marked as exploited before a fix was available.
Prioritize the exploited Outlook flaw
Its reported exploitation status matters for patch planning, even though Microsoft rates it Moderate.
The supplied guidance recommends addressing these updates first.
Review Critical server vulnerabilities against the products your organization operates.
Reports described uncertainty about availability of the version identified as working.
What the Outlook flaw means
CVE-2026-124194 is marked “Exploitation Detected” in the supplied report.
- A crafted file can prompt exposure of an NTLMv2 password hash when opened.
- CISA added the flaw to its exploited-vulnerabilities list on November 10.
- How many people or organizations were affected.
- Who carried out the attacks or which users were targeted.
The release spans many products
Windows and Office account for most of the listed product-family CVEs.
High counts do not equal more attacks
The source reports one flaw marked exploited in November, while monthly listed CVE counts rose sharply.
| Measure | What the source says |
|---|---|
| November listed CVEs | 1,094 Microsoft CVEs |
| Known exploited this month | One marked exploited |
| AI researcher credits | 24 lines mention AI models |
| AI discovery share | Microsoft has not disclosed it |
Prioritize the Exploited Outlook Flaw
The large CVE count signals a substantial update workload for organizations that manage Windows, Office, servers and Microsoft’s other products. But the most urgent item cannot be identified by counting severity ratings alone: the Outlook flaw is rated Moderate while being the release’s only entry marked “Exploitation Detected.” That makes its reported in-the-wild status a key factor for patch prioritization.
For administrators, the supplied source recommends addressing Outlook and Office first, then reviewing the Critical server vulnerabilities that affect their environments. That is practical guidance from the source, not a Microsoft-issued priority order. The Paint issue also calls for a separate version check, since the reports cited describe a mismatch between Microsoft’s initial fix information and what some users could obtain.
The growth in the monthly total should not be confused with a matching rise in confirmed attacks. The source’s analysis of Microsoft’s monthly data says the number of flaws marked as exploited stayed between zero and six per month, with one in November. The volume of published vulnerabilities and the number known to be exploited are different measures.
Products Worth Considering
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
Apple Watch Series 12 GPS 42mm Smartwatch
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in Monthly CVE Counts
Microsoft’s November total is far above the 63 Microsoft CVEs listed for November 2025 in the release-note comparison cited by ThorstenMeyerAI.com. That analysis reports 220 in June 2026, 663 in July, 999 in September and 1,474 in October. It calculates January through November 2026 at 5,523 CVEs. Those figures use the source’s stated method and should be read as counts of listed Microsoft CVEs, not as a measure of attacks or affected customers.
Microsoft has previously attributed part of the higher discovery volume to improved security tools and research, including AI. In May, Tom Gallagher, a Microsoft Security Response Center engineering vice president, wrote that advanced AI models were “part of the discovery picture” and that releases were expected to “continue trending larger for some time.” He also said the change was not driven by one model or one factor, citing automation and broader participation by outside researchers.
The supplied report counts 24 November CVE credit lines that mention a researcher using an AI model: 23 credit GLM from z.ai and one credits Claude. Those credits show researcher attribution, not the proportion of vulnerabilities found by AI overall. They do not disclose Microsoft’s internal tools or establish how AI contributed to the full release.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide release notes
Questions About Impact and Fixes
The supplied material does not say how many attacks used CVE-2026-124194, who carried them out, or which users were targeted. CISA’s listing and Microsoft’s exploitation flag support reporting that the flaw was exploited, but they do not establish the scale or consequences of that activity.
Microsoft has not disclosed what share of the 1,094 issues was discovered with AI, whether its own AI tools contributed to specific fixes, or how much of the growth reflects changes in discovery, reporting or release practices. The 24 researcher credit lines identified in the source cannot answer those questions.
The Paint fix’s availability also remains uncertain in the cited reports: the source says the version identified as working was not appearing for some users. The provided material does not give a definitive rollout schedule, explain which users remain affected, or establish the current status beyond those reports.
Check Updates Across Affected Products
Organizations should review Microsoft’s November Security Update Guide against the products they operate, giving particular attention to the Outlook and Office updates and to any Critical server flaws relevant to their systems. The supplied source recommends checking the Paint version separately through the Microsoft Store. Users should confirm that the update is installed rather than relying only on the initial vulnerability notice.
Further clarity may come from Microsoft’s updates to its security guidance, additional CISA information, and reports on the Paint rollout. Until those details are available, the number of affected users, the breadth of exploitation and the complete availability of the Paint fix remain unconfirmed.
Key Questions
What did Microsoft release on November 10, 2026?
Microsoft’s Security Update Guide release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the difference is one Entra Device Registration flaw published on November 5.
Which vulnerability was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is marked “Exploitation Detected” in the supplied report. The report says opening a crafted file can expose an NTLMv2 password hash.
How severe is the Outlook vulnerability?
Microsoft rates it Moderate and gives it a CVSS score of 6.5. Its reported exploitation status makes it relevant to patch prioritization even though it is not rated Critical.
Does the release show that AI found most of the flaws?
No. Microsoft has said AI contributes to vulnerability discovery, but it has not disclosed how many November issues involved AI. The source identifies 24 researcher credit lines mentioning AI models; that does not measure Microsoft’s internal use or the share of all flaws found with AI.
What is the concern about Microsoft Paint?
The supplied source says the Paint flaw CVE-2026-83844 was published on October 13 and that the version first identified as fixed remained vulnerable, according to heise. It cites version 11.2609.401.0 as the working version but says PC Gamer reported that it was not visible to some users.
Source: ThorstenMeyerAI.com
