🔍 Read the full analysis: Microsoft Patches 1,094 Flaws, Including One Under Attack; Paint Also Needs A Fix on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company says was exploited before a fix became available. A separate Paint vulnerability has a reported version discrepancy, and some users may not yet see the updated app. Microsoft has not said how many November fixes were found with AI tools.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company marked as exploited before a fix was available. The release also comes amid a separate issue with Microsoft Paint’s fix version, which security coverage says may not yet be available to all users.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 fixes published that day; the difference is one Entra Device Registration issue, CVE-2026-109469, which Microsoft published on November 5 and says requires no customer action. The figures count Microsoft’s own CVEs, rather than simply combining them with vulnerabilities from other vendors listed in Microsoft’s data.
The active-exploitation entry is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability rated Moderate, with a CVSS score of 6.5. Microsoft describes a scenario in which an unauthenticated attacker sends a specially crafted file that can expose a user’s NTLMv2 password hash. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10. That classification indicates reported exploitation; it does not establish how many people or organizations were affected.
A separate Paint issue, CVE-2026-83844, was published October 13. According to heise, the Paint version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, while PC Gamer reported that the update was still not appearing for some users. These Paint details are separate from the 1,094-CVE November release and should be checked independently.
November patches target 1,094 reported flaws
Microsoft flagged an Outlook flaw as exploited before a fix was available. Paint’s reported fix version needs a separate check.
Prioritize the Outlook update
The flaw is rated Moderate, but the reported attack path could expose authentication material.
Check Microsoft’s update guidance and prioritize applicable fixes, especially on systems handling untrusted files.
Review Critical server updates against products and versions in your environment.
The release count needs context
A separate count differs because one CVE was published earlier.
| Count | What it covers |
|---|---|
| 1,094 | Microsoft’s November release listing |
| 1,093 | Fixes counted as published November 10 |
| 1 | Entra issue published November 5; no customer action required |
Check Paint separately
The Paint issue is separate from the November CVE total, and reports say some users had not received the update.
- Check the installed Paint version.
- Look for version 11.2609.401.0 in the Microsoft Store.
- Confirm the version is available and applies to your device.
Prioritize the Exploited Outlook Flaw
The release’s headline count is large, but the clearest immediate priority is the Outlook vulnerability marked as exploited. Its Moderate rating does not mean it can be ignored: the reported attack path involves opening a crafted file and could expose authentication material. Organizations should review Microsoft’s update guidance and prioritize applying the relevant Outlook and Office fixes, particularly on systems used to handle untrusted files.
Administrators also need to sort the wider release by products deployed and severity, rather than treating 1,094 as 1,094 equally urgent incidents. The source’s product breakdown lists 726 Windows CVEs, 174 for Office, 59 for SQL Server, 53 for Developer Tools and 27 for SharePoint Server, among other categories. The source recommends addressing the Outlook and Office updates first, then reviewing Critical server vulnerabilities relevant to each network. The Paint version issue calls for a separate check through the Microsoft Store.
The increase in recorded fixes matters for security teams because it can affect triage, testing and rollout workload. It does not, by itself, show that the number of attacks has risen at the same pace. The source’s review of Microsoft’s monthly data found zero to six exploited entries per month, with one in November, even as the overall count of listed CVEs grew. Those figures describe entries flagged in the data, not a complete measure of real-world attacks.
Products Worth Considering
Canon MAXIFY GX2020 MegaTank Wireless All-in-One Color Inkjet Printer
Apple iPad Air 11-inch (M4), 128GB, Wi-Fi 7, Space Gray
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
A Rapid Rise in Monthly CVE Counts
The November total follows an unusually high run of monthly figures reported from Microsoft’s Security Update Guide. The source gives 63 Microsoft CVEs for November 2025 and 65 for December 2025, followed by 220 in June 2026, 663 in July, 999 in September and 1,474 in October. On that comparison, November 2026’s 1,094 entries are about 17 times November 2025’s 63. The source also calculates 5,523 Microsoft CVEs from January through November 2026. These are counts from the guide, not a measure of severity or successful attacks.
Microsoft has pointed to several factors behind larger releases. In April, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, wrote that AI can find more issues across a broader surface area, and Microsoft disclosed early access to Anthropic’s Claude Mythos Preview. In May, Gallagher said advanced AI models were part of vulnerability discovery, while also citing more mature automation and broader participation by outside researchers. Microsoft said it expected releases to remain larger for some time and that it was not changing its standard for what qualifies as a bug.
The November credit lines do not establish how much AI contributed to the total. The source counted 24 entries among the 1,093 published November 10 that credited researchers working “using” an AI model: 23 referenced GLM from z.ai and one referenced Claude. The Outlook flaw’s credit line names Benoît Sevens using Claude with Anthropic, as well as a second researcher identified as “nono.” Such acknowledgments concern credited discovery work; they do not reveal Microsoft’s internal tools or quantify AI’s share of the full release.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 10, 2026 release notes
What the Counts Cannot Establish
Microsoft has not disclosed how many November fixes were discovered with AI, whether internally or by outside researchers. The 24 AI-related researcher credit lines reported in the source are not a complete accounting, and they cannot be used to estimate AI’s share of the 1,094 CVEs.
The source says the November data marks one vulnerability as exploited, but the supplied material does not state the scale, targets or duration of exploitation for CVE-2026-124194. The presence of a flaw in CISA’s exploited-vulnerability catalog is not, on its own, evidence that a particular reader’s device was compromised. The impact of the Paint issue is also not established for every installation: reports say some users had not received the identified version, but the source does not provide a complete rollout status or explain the cause of the delay.
There is also a small difference in the reported release totals. Microsoft lists 1,094 CVEs in its release notes, while Krebs on Security counts 1,093 published on November 10. The source attributes that gap to CVE-2026-109469, published five days earlier, and says Microsoft requires no customer action for it. Readers should keep the publication date and counting method attached to each figure.
Check Outlook, Servers and Paint
Organizations should consult Microsoft’s Security Update Guide for the applicable Outlook and Office updates, then assess the release’s Critical server fixes against their own systems. Microsoft has not provided a single action list that fits every network; administrators need to match affected products and versions to their deployments and follow the relevant update instructions.
For Paint, users and IT teams should check the installed app version and look for 11.2609.401.0 through the Microsoft Store, while confirming that the version is available and applicable on their devices. The reports supplied here indicate that rollout was incomplete for some users, so seeing an older version does not by itself establish why the update is missing or when it will arrive.
Further clarity may come from Microsoft update guidance, changes to the Paint rollout and additional reporting on exploitation. Until then, the confirmed points are the release’s stated CVE count, Microsoft’s exploitation flag for the Outlook flaw and the reported Paint version issue; the extent of attacks and the full role of AI remain unreported.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source attributes the difference to an Entra Device Registration CVE published November 5.
Which vulnerability was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is the entry marked as exploited in the supplied account. Microsoft says a specially crafted file could expose a user’s NTLMv2 password hash. CISA added it to its exploited-vulnerability catalog on November 10.
Does the November total mean attacks increased 17-fold?
No. The roughly 17-fold comparison is between the number of listed Microsoft CVEs in November 2026 and November 2025, 1,094 versus 63. The source’s review found zero to six entries marked exploited per month, including one in November; those counts do not measure all attacks.
What is the issue with the Microsoft Paint update?
The source says Paint vulnerability CVE-2026-83844 was published October 13, and reports that the version initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 on November 6, but PC Gamer reported that some users still could not see it. Check the app through the Microsoft Store and verify the installed version.
Has Microsoft said AI found all or most of the November flaws?
No. Microsoft has said AI is part of its vulnerability-discovery process, alongside automation and outside researchers, but has not given an AI-attributed share for the November release. Researcher credit lines do not account for Microsoft’s internal discovery methods.
Source: ThorstenMeyerAI.com
