🔍 Read the full analysis: Microsoft Patches 1,094 Flaws; One Is Under Attack And Paint Gets Attention on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, and one Outlook vulnerability was exploited before a fix became available. A separate Paint vulnerability has a fix version identified, but reports say some users still cannot get it through the Microsoft Store. Microsoft has not said how many November fixes were found with AI tools.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability exploited before its fix was issued. The release also brings renewed attention to a separate Paint flaw: reporting says the version initially identified as fixed remained vulnerable, while some users still cannot see the later fix version.
Microsoft describes CVE-2026-124194 as an Outlook spoofing vulnerability and rates it Moderate, with a CVSS score of 6.5. The company marks it “Exploitation Detected.” According to the supplied account of Microsoft’s description, an unauthenticated attacker could use a specially crafted file to expose a user’s NTLMv2 password hash. The Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10.
The release count is unusually high compared with the same month a year earlier: Microsoft’s November 2025 release notes listed 63 CVEs. The source’s review of Microsoft’s monthly data records 1,094 Microsoft CVEs in November 2026, while Krebs on Security counted 1,093 fixes published that day. The one-item difference is CVE-2026-109469, a Critical Entra Device Registration flaw Microsoft published on November 5 and for which it says customers need take no action.
The Paint issue is CVE-2026-83844, published on October 13. Heise reported that the Paint version Microsoft first named as fixed was still vulnerable. Microsoft identified version 11.2609.401.0 as the working version on November 6; PC Gamer reported that it was not appearing for some users. The available source material does not establish how many people remain affected or whether distribution has since reached all users.
Microsoft patches 1,094 flaws One Outlook flaw is under attack
The November release includes an exploited Outlook vulnerability and a separate Paint fix whose availability remains unclear for some users.
Prioritize Outlook updates
Microsoft marked CVE-2026-124194 as exploitation detected; CISA added it to its exploited vulnerabilities catalog.
Moderate severity, active exploitation
The reported risk is exposure of a user’s NTLMv2 password hash through a specially crafted file.
Check applicable Office updates
Administrators should review the advisory and prioritize systems that apply to their environment.
Make sense of the count
The total covers Microsoft’s CVEs, not every vulnerability in the machine-readable release file.
- 1,094 CVEs in the monthly data
- Includes an Entra flaw published November 5
- Krebs on Security counted 1,093 fixes that day
- The one-item difference is the earlier Entra flaw
Check Paint separately
The reported working version is 11.2609.401.0, but its availability through the Microsoft Store remains uncertain.
See whether Paint is version 11.2609.401.0.
Look for an update if the installed version is older.
The Outlook Risk Takes Priority
The exploited Outlook flaw deserves attention despite its Moderate rating. A severity score is not the same as evidence of active exploitation: Microsoft marks this vulnerability as exploited, and CISA added it to its exploited-flaw list. The reported possibility of exposing an NTLMv2 hash gives defenders a concrete reason to prioritize the Outlook and Office updates, particularly on systems used to open files from untrusted sources.
The release’s size also affects how organizations manage patching. The source’s product breakdown attributes 726 CVEs to Windows, 174 to Office and 59 to SQL Server, among other products. Those counts do not mean every system is affected by every flaw. Administrators need to match the advisories to products and configurations they actually run, then prioritize the issues that apply to their networks. For individual users, the immediate concern is installing applicable Office updates and checking Paint separately rather than assuming its fix arrived with the regular release.
The rising count is not, by itself, evidence that attackers are exploiting a similar number of new flaws. The source’s count of Microsoft’s monthly data found between zero and six exploited entries per month, with one in November. That is a count of entries marked “Exploited: Yes,” not a measure of attacks against a particular user or organization.
Products Worth Considering
Bose TV Speaker (2nd Gen) Compact Soundbar
Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones – Midnight Blue
Jackery Explorer 300 Portable Power Station with 40W Solar Panel
As an affiliate, we earn on qualifying purchases.
Why November’s Count Is So High
The release notes count reflects Microsoft’s own CVEs, rather than simply adding vulnerabilities from every vendor whose software appears in Microsoft’s security data. The source says the November machine-readable file contained 1,342 entries, including 247 attributed to other vendors, mainly Chrome issues also relevant to Microsoft Edge. After separating those records and accounting for an Edge entry, the source arrives at Microsoft’s stated total of 1,094. Krebs on Security’s 1,093 figure counts the vulnerabilities published on November 10, excluding the Entra issue disclosed five days earlier.
Microsoft has attributed the larger volume of discovered vulnerabilities to several factors, including AI-assisted discovery, more mature automation and wider participation by external researchers. In an April post, MSRC engineering vice president Tom Gallagher wrote that AI “can discover more issues, more quickly, across a broader surface area than previous methods.” In May, he said advanced AI models were “part of the discovery picture” and expected releases “to continue trending larger for some time.”
The November data does not reveal how much of the increase came from AI. The source counted 24 November entries with credits referring to an AI model: 23 citing GLM from z.ai and one citing Claude. Those acknowledgments concern credited research and do not disclose Microsoft’s internal tools or establish how many flaws AI found across the release. The source also reports a year-to-date total of 5,523 Microsoft CVEs through November, based on its own count of Microsoft’s monthly data.
“Advanced AI models are part of the discovery picture and help to accelerate it.”
— Microsoft Security Response Center engineering vice president Tom Gallagher, in a May post
What the Fix Data Cannot Show
Microsoft has not disclosed how many of the November flaws were identified with AI. Researcher credit lines provide limited information about specific credited discoveries; they do not show which tools Microsoft used internally or how much those tools contributed to the release total.
The supplied source does not include the complete technical advisory for CVE-2026-124194: its quoted description ends mid-sentence. It reports that a crafted file could expose an NTLMv2 hash and that exploitation was detected, but does not specify the number of attacks, affected organizations or the full conditions required for exploitation. The listing on CISA’s catalog confirms the agency’s inclusion of the flaw, not the scale or outcome of attacks.
For Paint, it remains unclear from the available reporting how widely version 11.2609.401.0 has been distributed, how many users still lack it, and whether Microsoft has issued a further update since November 6. The difference between Microsoft’s 1,094 total and Krebs’s 1,093 is accounted for in the source by the earlier Entra publication, rather than a disagreement over the November 10 count.
Check Outlook, Then Paint
Users and administrators should install applicable Outlook and Office security updates and review Microsoft’s guidance for CVE-2026-124194. Organizations should then assess the Critical server flaws against the products and configurations they operate; the release includes fixes across Windows, SQL Server, SharePoint Server, Azure and other Microsoft products. The source recommends prioritizing relevant server updates rather than treating the full count as a single uniform risk.
Paint should be checked separately through the Microsoft Store. Users can verify whether the installed application is version 11.2609.401.0, the version identified as working in the supplied reporting, and check for an update if it is not. Microsoft may provide further information about Paint availability or the November vulnerabilities, but the source material gives no date for a follow-up advisory or a complete rollout.
Key Questions
What is the most urgent vulnerability in Microsoft’s November release?
CVE-2026-124194 in Outlook is the release’s identified exploited flaw. Microsoft rates it Moderate, but the exploitation flag and CISA listing make it a priority for users and administrators with affected software.
What does the Outlook flaw reportedly allow?
The supplied account says opening a specially crafted file could expose an NTLMv2 password hash. The source does not provide the full technical advisory or details about the scale of exploitation.
Why do reports give two different totals?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the supplied source says the remaining Entra Device Registration flaw was published on November 5 and requires no customer action.
Is the Paint vulnerability fixed for everyone?
That is not established in the available reporting. Version 11.2609.401.0 was identified as the working version on November 6, but PC Gamer reported that some users could not see it. Check Paint’s version and the Microsoft Store for an update.
Did AI find all or most of the November flaws?
Microsoft has not said how many of the November fixes were found with AI. Some researcher credits mention AI models, but those entries do not reveal Microsoft’s internal use of AI or its share of the total.
Source: ThorstenMeyerAI.com
