🔍 Read the full analysis: Microsoft Patch Tuesday Fixes 1,094 Flaws, With A Separate Fix For Paint on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, Patch Tuesday release notes list 1,094 Microsoft CVEs, including an Outlook vulnerability marked as exploited before a fix was available. A separate Paint flaw has a reported fix, but the version history and availability for some users remain unclear.
Microsoft’s November 10, 2026, Patch Tuesday release lists fixes for 1,094 Microsoft CVEs, including an Outlook flaw that Microsoft says attackers exploited before a patch was available. Separately, a fix for a Paint vulnerability has faced reported problems: the version initially identified by Microsoft was still vulnerable, and some users reportedly have not received the later version identified as working.
Microsoft’s Security Update Guide release notes state that the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the difference is CVE-2026-109469, an Entra Device Registration flaw published November 5. Microsoft says that issue requires no customer action. According to the source material’s review of Microsoft’s data, the total excludes vulnerabilities attributed to other vendors.
The most time-sensitive item identified in the release is CVE-2026-124194 in Outlook. Microsoft rates it Moderate, with a CVSS score of 6.5, and marks it as having exploitation detected. The source reports that opening a specially crafted file can expose a user’s NTLMv2 password hash, and that the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of known exploited vulnerabilities on November 10. The supplied material does not include Microsoft’s full technical description or details about the attacks.
The release also includes a large concentration of Windows fixes: 726 CVEs, according to the product breakdown cited in the source. Office accounts for 174, SQL Server 59, Developer Tools 53, SharePoint Server 27, other products 25, Azure 20, Exchange Server 9 and Defender 1. The article source says the November data file contains 1,095 entries naming Microsoft as issuer, with one Edge entry removed to reconcile the release-note total.
Paint’s separate vulnerability, CVE-2026-83844, was published October 13. According to the source, heise reported that the Paint version Microsoft first identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6; PC Gamer reported that the update was still unavailable to some users. This Paint issue is separate from the November 10 Patch Tuesday CVE count.
Microsoft fixes 1,094 flaws with a separate Paint update
The November 10 release includes an Outlook flaw Microsoft says attackers exploited before a fix was available. Paint’s separate fix has reported version and rollout problems.
Prioritize the exploited Outlook flaw
Its Moderate rating does not capture the added urgency of Microsoft’s exploitation flag.
CVE-2026-124194
Opening a specially crafted file can expose a user’s NTLMv2 password hash. CISA added it to its known exploited vulnerabilities catalog on November 10.
Separate vulnerability
CVE-2026-83844 is outside the November Patch Tuesday count. The initially identified fixed version reportedly remained vulnerable.
Where the fixes are concentrated
Product counts can help organizations identify which updates may affect their systems.
| Product | CVEs |
|---|---|
| Windows | 726 |
| Office | 174 |
| SQL Server | 59 |
| Developer Tools | 53 |
| SharePoint Server | 27 |
| Other products | 25 |
| Azure | 20 |
| Exchange Server | 9 |
| Defender | 1 |
Check versions and deploy relevant updates
Match updates to the products and versions your organization runs, following its testing and response processes.
Identify applicable November updates for your products and versions.
Account for the exploitation flag as well as the Moderate severity rating.
Check the installed version and current Microsoft guidance; version 11.2609.401.0 was named as working on November 6, but some users reportedly had not received it.
Prioritized Patching for Outlook and Windows
The headline total is large, but the number alone does not show which flaws pose the most immediate risk. The Outlook vulnerability stands out because Microsoft marks it as exploited, even though its severity rating is Moderate. That makes its exploitation status relevant alongside the rating when administrators decide which updates to test and deploy first.
The broad Windows and Office counts also mean the release may affect a wide range of organizations and individual users. Administrators need to identify which products and versions they operate, apply relevant security updates, and follow their normal testing and deployment procedures. The source advises addressing Outlook and Office updates, then reviewing Critical server fixes applicable to an organization’s systems. That is source-provided guidance, not a substitute for an organization’s own security assessment.
The Paint version discrepancy adds a separate verification task for affected users. A fix being named does not establish that every device has received it or that the update is installed. Users and administrators should check the installed Paint version and Microsoft’s current update information rather than assume the October report or an automatic rollout resolved the issue for everyone.
Products Worth Considering
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
Ledger Stax Crypto Wallet with Touchscreen
Ledger Nano X Bluetooth Crypto Wallet
As an affiliate, we earn on qualifying purchases.
How the Patch Count Grew
The November figure is a sharp change from the same month a year earlier. Microsoft’s release notes listed 63 Microsoft CVEs in November 2025, compared with 1,094 in November 2026. The source’s month-by-month tally records 220 in June 2026, 663 in July, 999 in September and 1,474 in October. These are counts of listed CVEs, not a direct measure of the severity of the vulnerabilities or the number of distinct attacks.
Microsoft has attributed the larger releases to several factors. In an April post, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, wrote that AI can help find more issues across a broader surface area. In May, he said advanced AI models were part of vulnerability discovery, while also citing improved automation and more contributions from outside researchers. Microsoft said it expected releases to remain larger for some time and that it was not changing its criteria for accepting bugs.
The source’s review of November entries found that 24 of the 1,093 CVEs published November 10 credited researchers with using an AI model: 23 cited GLM from z.ai and one cited Claude. Those credits describe researchers’ reported tools, not Microsoft’s internal discovery process. The source also counted between zero and six flaws marked as exploited in each monthly data file, with one in November. That measure differs from the total CVE count and does not establish the full extent of attacker activity.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
Paint Rollout and Attack Details
Microsoft has not said how many November fixes resulted from AI-assisted discovery. Researcher credit lines do not show which tools Microsoft’s own teams used, so the 24 entries identified in the source cannot establish AI’s share of the release.
The supplied material does not describe the Outlook attacks’ scale, targets, or duration, nor does it provide Microsoft’s complete technical guidance for CVE-2026-124194. It reports that the flaw is exploited and that CISA listed it, but does not establish how many users or organizations were affected.
For Paint, the source reports conflicting version and availability information but does not establish the current rollout status for every device or provide a complete account of Microsoft’s response. Users’ installed versions and update availability may differ.
Check Installed Updates and Versions
Organizations should consult Microsoft’s Security Update Guide for the affected products and their specific versions, then deploy applicable November security updates according to their testing and response processes. The Outlook fix merits particular attention because Microsoft flags exploitation, while server updates should be assessed against each organization’s software and exposure.
For Paint, users and administrators can check the Microsoft Store and confirm the installed version against Microsoft’s latest guidance. Further clarification from Microsoft on the rollout and the vulnerable version history would help resolve reports that some users have not received the working release. The status of attacks using the Outlook flaw and the share of fixes linked to AI discovery also remain open questions.
Key Questions
How many CVEs are in Microsoft’s November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source says one additional Entra Device Registration CVE was published November 5 and requires no customer action.
Which November flaw is reported as exploited?
CVE-2026-124194 in Outlook is marked by Microsoft as having exploitation detected. The source says it can expose a user’s NTLMv2 password hash when a specially crafted file is opened, and reports that CISA added it to its exploited-vulnerabilities catalog on November 10.
Is the Paint vulnerability part of the 1,094-CVE release?
No. CVE-2026-83844 is a separate Paint vulnerability published October 13. The source reports that Microsoft named version 11.2609.401.0 as the working version on November 6, but some users may not yet have received it.
Has Microsoft said how many fixes were found using AI?
No. Microsoft has said AI is part of its vulnerability-discovery process, alongside automation and outside research, but has not given a number for its contribution to the November release. Researcher credit lines do not reveal Microsoft’s internal tool use.
Source: ThorstenMeyerAI.com
