TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook flaw that the company says was exploited before a fix was available. The source reports a separate Paint patch problem and says the version identified as working may not yet be available to all users.
Microsoft’s November 10 security update lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says attackers exploited before a fix was available. The release also renews questions about Microsoft’s sharply higher monthly vulnerability counts and includes a separate Paint issue for which the source says some users may still lack the working version.
The Outlook issue, CVE-2026-124194, can expose a user’s NTLMv2 password hash when they open a crafted file, according to the source material. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited flaws on November 10. The material does not specify how many attacks involved the flaw or identify affected victims.
Microsoft’s Security Update Guide release notes say the November release consists of 1,094 Microsoft CVEs. Krebs on Security reported 1,093 fixes published that day; the source attributes the one-item difference to CVE-2026-109469, a Critical Entra Device Registration flaw published on November 5. Microsoft says no customer action is needed for that issue. The source’s count excludes vulnerabilities attributed to other vendors that also appear in Microsoft’s data.
A separate Paint vulnerability, CVE-2026-83844, was published on October 13. The source says heise reported that the version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, but PC Gamer reported that it was not appearing for some users. This Paint issue is distinct from the exploited Outlook flaw.
Prioritize the Outlook Fix
The exploited Outlook flaw makes the release time-sensitive for organizations that use Outlook, especially where opening untrusted files could expose account credentials. Microsoft’s release information, as described in the source, indicates a hash disclosure risk; the source does not establish that attackers can use the flaw to obtain a plaintext password or gain access to an account.
The size of the release also affects patch planning. Microsoft’s listed product families include 726 Windows CVEs, 174 for Office, 59 for SQL Server, and 53 for Developer Tools. The counts indicate where fixes are concentrated, but do not by themselves show which products are most exposed in a particular organization. Administrators need to match the advisories to the software they run and prioritize based on exploit status and local exposure.
The Paint reports add a practical complication: installing a version named in an advisory may not be enough if that build remains vulnerable or the working build has not reached a device. The available material does not establish how widespread that availability issue is.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
How the CVE Count Grew
The source’s review of Microsoft Security Update Guide release notes puts November 2025 at 63 Microsoft CVEs, compared with 1,094 in November 2026. It reports 1,474 in October 2026, 999 in September, 663 in July and 220 in June. Those are monthly counts, and comparisons depend on the source’s counting method; Microsoft’s notes and Krebs on Security differ by one for November because of a flaw published five days earlier.
Microsoft has previously linked larger releases to more effective vulnerability discovery. In an April post, Tom Gallagher, a vice president of engineering at the Microsoft Security Response Center, said AI can find more issues across a broader surface area. In May, he wrote that advanced AI models are part of the discovery process, while also citing improved automation and more outside researchers. Microsoft said it expected releases to continue trending larger for some time and that it was not changing its standard for fixing bugs.
The November source identifies AI-related researcher credits on 24 of the 1,093 CVEs it says were published that day: 23 cite GLM from z.ai and one cites Claude. Those acknowledgments do not show how many issues Microsoft found internally with AI tools. The source also reports that the Outlook flaw’s credit line names Benoît Sevens using Claude with Anthropic and a second researcher identified as “nono.”
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 10, 2026 release notes
Open Questions on Exposure
The source does not provide a count of attacks involving CVE-2026-124194, details about affected organizations, or evidence that the issue has been used beyond the reported exploitation. It also does not specify how quickly customers should expect the Outlook fix to reach every supported product configuration.
Microsoft has not stated how many of November’s vulnerabilities were discovered with AI tools. The 24 researcher credit lines described in the source do not account for Microsoft’s internal discovery methods, so they cannot establish AI’s share of the release. The one-CVE difference between Microsoft’s release-note total and Krebs on Security’s same-day count reflects a timing and counting distinction in the source.
For Paint, the source does not establish how many users still cannot access version 11.2609.401.0 or whether Microsoft has since resolved distribution problems. The extent of the vulnerability’s impact is also not detailed in the supplied material.
Check Fixes Against Your Systems
Organizations should review Microsoft’s November advisories and prioritize the Outlook fix, then assess the listed Critical server vulnerabilities against the products and configurations they operate. Microsoft’s release data includes issues across Windows, Office, SQL Server, Developer Tools, SharePoint Server, Azure, Exchange Server, Defender and other products, so the relevant patches will vary by environment.
Paint users and administrators can check the Microsoft Store for the version identified in the source as working, 11.2609.401.0, and verify that it is installed. The source provides no later update on availability, so users may need to consult current Microsoft guidance for their device. Further details about exploitation, patch distribution and Microsoft’s use of AI in vulnerability discovery may emerge as advisories and reporting are updated.
Key Questions
What did Microsoft release on November 10?
Microsoft’s November Patch Tuesday release notes list 1,094 Microsoft CVEs. The source says Krebs on Security counted 1,093 published that day because one additional flaw had been published on November 5.
Which flaw was reported as exploited?
CVE-2026-124194, an Outlook vulnerability, was reported as exploited before a fix was available. According to the source, opening a crafted file can expose a user’s NTLMv2 password hash.
Does Microsoft say AI found most of the November flaws?
No. Microsoft has said AI models are part of its vulnerability discovery process, alongside automation and outside research. The source says Microsoft has not disclosed how many November fixes were found with AI.
What should users know about the Paint issue?
The source says CVE-2026-83844 was published on October 13 and that reports questioned whether the initially named fix worked. Microsoft identified version 11.2609.401.0 as working on November 6, but the source says some users could not yet see that version.
Source: Thorsten Meyer AI
