🔍 Read the full analysis: Microsoft’s Patch Tuesday: 1,094 Fixes And A Vulnerability Under Attack on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that the company says was exploited before a fix. CISA added the flaw to its catalog of vulnerabilities known to be exploited; Microsoft has not disclosed how many of the month’s fixes were found with AI.
Microsoft’s November 10 security update lists 1,094 Microsoft CVEs, and one of them, a vulnerability in Outlook, was exploited before a fix was available. The Outlook flaw, CVE-2026-124194, can expose a user’s NTLMv2 password hash when a crafted file is opened, according to Microsoft’s description; CISA added it to its list of known exploited vulnerabilities on November 10.
The figure comes from Microsoft’s November release notes, which state that the release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 vulnerabilities published on November 10. The difference is CVE-2026-109469, a Critical Entra Device Registration flaw published five days earlier. Microsoft says no customer action is needed for that issue.
The source’s review of Microsoft’s machine-readable update data says the November file contains entries from other vendors as well as Microsoft. After excluding those entries and an Edge entry, the count matches Microsoft’s 1,094. The review says 1,093 entries were first published on November 10, while the additional Entra flaw was published November 5.
Microsoft rates the Outlook issue Moderate, with a CVSS score of 6.5, but marks it “Exploitation Detected.” That makes it the only vulnerability in the November release identified in the source material as already exploited. The report says opening a crafted file can leak the user’s NTLMv2 password hash. The supplied description does not include further technical details about the attack method or the scope of exploitation.
Microsoft’s November Patch Tuesday 1,094 fixes and an Outlook flaw under attack
Microsoft’s November 10, 2026 release lists 1,094 Microsoft CVEs. One Outlook vulnerability was exploited before a fix was available.
The urgent vulnerability
Microsoft marked the Outlook flaw as exploited, and CISA added it to its known exploited vulnerabilities catalog.
CVE-2026-124194
Opening a crafted file can expose a user’s NTLMv2 password hash. The supplied information does not quantify affected users or attacks.
Check the version
The source advises checking for Paint version 11.2609.401.0; availability was reportedly inconsistent.
Release counts over time
Counts show the scale of listed vulnerabilities, not how many were exploited or the risk each presents.
What the counts tell teams
The headline total needs context when planning patch work.
- Review Outlook and Office updates promptly.
- Assess Critical server flaws against products in use.
- Check Microsoft’s guidance and your environment’s needs.
- The 1,094 total includes an Entra flaw published November 5.
- Microsoft has not disclosed how many fixes came from AI-assisted discovery.
- Listed CVEs do not measure exploitation or individual risk.
Why the Outlook Flaw Takes Priority
The month’s largest security-update count does not by itself identify the most urgent risk for an organization. In this release, the clearest immediate signal is Microsoft’s exploitation flag for the Outlook vulnerability, reinforced by CISA’s addition of it to the agency’s known-exploited list. Administrators can use those indicators when prioritizing deployment, alongside the systems and products their organizations actually run.
The source recommends patching Outlook and Office first, then reviewing the Critical server flaws relevant to each network. That is a prioritization suggestion from the source, not a substitute for an organization’s own risk assessment. The reported possibility of exposing an NTLMv2 password hash also gives security teams a reason to review the vulnerability and Microsoft’s mitigation guidance promptly; the source does not establish how many users or organizations have been affected.
The overall volume is also relevant to IT teams’ patching capacity. The source’s count rose from 63 Microsoft CVEs in November 2025 to 1,094 in November 2026. That comparison concerns the number of listed vulnerabilities, not proof that systems are less secure or that attackers have gained a corresponding increase in opportunities.
Popular right now
Dyson V12 Detect Slim Absolute Cordless Stick Vacuum
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
As an affiliate, we earn on qualifying purchases.
How the Patch Count Grew
Microsoft’s November figure follows a run of unusually large releases, according to the source’s review of the company’s Security Update Guide data. It lists 220 CVEs in June 2026, 663 in July, 999 in September and 1,474 in October, before November’s 1,094. The same review calculates 5,523 Microsoft CVEs from January through November 2026. These are counts of listed CVEs, not a measure of how many were exploited or how much risk each presents.
Microsoft has pointed to several factors behind rising release totals. In April, Tom Gallagher, a Microsoft Security Response Center engineering vice president, said AI can help discover more issues across a broader area. In May, Gallagher wrote that “Advanced AI models are part of the discovery picture” and said releases were expected to continue trending larger for some time. Microsoft also cited more mature automation and broader participation by outside researchers, while saying the trend was not driven by one model or one change.
The source identifies AI-related wording in the credit lines for 24 of the 1,093 November entries published on release day: 23 credits mention GLM from z.ai, and one mentions Claude. Those credits do not reveal how many issues Microsoft found using its own internal tools. Microsoft has not said what share of November’s fixes resulted from AI-assisted discovery.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft’s November 2026 Security Update Guide release notes
What the Release Data Cannot Show
The supplied material does not state how many attacks used CVE-2026-124194, which victims may have been targeted, or whether attackers obtained usable password hashes. Microsoft’s exploitation designation and CISA’s listing establish that the flaw was considered exploited, but they do not quantify the activity.
It is also unclear how much of November’s total resulted from AI-assisted discovery. Researcher credit lines identify some outside contributors’ tools, but do not describe Microsoft’s internal discovery process. The source reports a separate Paint issue, CVE-2026-83844, first published October 13: heise said the version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, while PC Gamer reported that it was not appearing for some users. The supplied material does not establish the issue’s current status for all users.
Patch Outlook and Check Paint
Organizations should review Microsoft’s November security guidance, prioritize the Outlook and Office updates, and assess the Critical server vulnerabilities against the products and services they use. Deployment timing and testing will depend on each environment. CISA’s addition of the Outlook flaw provides a further signal for teams tracking known exploitation.
For Paint, the source advises checking for version 11.2609.401.0 through the Microsoft Store, because availability was reportedly inconsistent. Microsoft’s release guidance and product updates may clarify whether affected users have received the corrected version. The supplied information does not give a deadline for installing the November updates or confirm when Paint availability will be uniform.
Key Questions
How many CVEs did Microsoft list in its November 2026 release?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the source attributes the difference to an Entra Device Registration flaw published November 5.
Which vulnerability was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, was marked “Exploitation Detected” by Microsoft. CISA added it to its list of known exploited vulnerabilities on November 10.
What can happen if the Outlook vulnerability is triggered?
According to the supplied description of Microsoft’s guidance, opening a crafted file can expose a user’s NTLMv2 password hash. The source does not say how many people or organizations have been affected.
Did Microsoft say AI found most of the November vulnerabilities?
No. Microsoft has said advanced AI models are part of its discovery process, alongside automation and outside researchers, but it has not disclosed how many November fixes came from AI.
What should users and administrators check next?
Review Microsoft’s security guidance and prioritize applicable Outlook and Office updates, followed by relevant Critical server fixes. For the separate Paint issue, the source recommends checking the Microsoft Store for version 11.2609.401.0.
Source: ThorstenMeyerAI.com
