TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, following 1,474 in October. One Outlook flaw, CVE-2026-124194, was exploited before a fix was released and can expose an NTLMv2 password hash when a user opens a crafted file. Microsoft has linked larger releases partly to AI-assisted discovery, but has not quantified AI’s role in this month’s fixes.
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook flaw that attackers had exploited before a fix was available. Microsoft says opening a crafted file can expose a user’s NTLMv2 password hash; the advisory does not establish how many people were affected.
The flaw, CVE-2026-124194, affects Outlook. Microsoft describes the attack as requiring a user to open a crafted file, which can leak the user’s NTLMv2 password hash. The source material does not provide a count of attacks, victims or affected organizations. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its catalog of known exploited flaws on November 10.
The overall release count is large, but published totals vary by one. Microsoft’s release notes say the update consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 vulnerabilities published that day. The source attributes the difference to CVE-2026-109469, a Critical Entra Device Registration flaw published on November 5; Microsoft says no customer action is needed for it.
Microsoft’s November data file contains entries from other vendors as well as Microsoft. The source’s count of the file identifies 1,095 entries with Microsoft as the issuing authority, then excludes one Edge entry to reach the 1,094 figure in Microsoft’s release notes. It says 1,093 Microsoft CVEs were first published on November 10. The listed product breakdown includes 726 Windows CVEs, 174 for Office, 59 for SQL Server, 53 for Developer Tools and 27 for SharePoint Server.
Prioritized Patching After the Release
The Outlook issue stands out because it was already exploited when Microsoft issued the November fixes. Organizations using Outlook should review Microsoft’s advisory and prioritize the applicable update, especially where users may open files from untrusted sources. CISA’s catalog listing gives security teams another signal to assess the flaw as they plan remediation.
The release also puts pressure on administrators to sort urgent exposure from a high overall count. Microsoft’s product figures show that most entries in this release concern Windows, with Office next; the counts alone do not show which products are deployed in any particular organization or which flaws pose the greatest local risk. The separate Critical server vulnerabilities should be assessed against the systems and services each organization actually runs.
A growing count of disclosed vulnerabilities does not by itself show that attackers have more opportunities or that every fix carries equal urgency. In the monthly data reviewed by the source, entries flagged as exploited ranged from zero to six per month; November’s count was one. That measure is limited to Microsoft’s dataset and its exploitation flag, but it offers a different picture from the four-digit total.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Monthly Counts Grew
Microsoft’s release notes listed 63 Microsoft CVEs in November 2025, compared with 1,094 in November 2026. The source’s comparison of those counts describes the later figure as about 17 times the earlier one. The release count also follows 1,474 in October 2026; a high monthly total is not new this autumn.
Microsoft has discussed several reasons for larger releases. In April, Tom Gallagher, a vice president of engineering at the Microsoft Security Response Center, said AI can help find more issues across a broader surface area. Microsoft also said it had early access to Anthropic’s Claude Mythos Preview. In a May post, Gallagher described advanced AI models as part of the discovery process, alongside more mature automation and wider participation by outside researchers. Microsoft said it expected releases to keep growing for some time and that it was not changing its threshold for fixing bugs.
The November records offer limited detail about AI’s contribution. According to the source’s review, 24 of 1,093 entries published on November 10 credited a researcher as using an AI model: 23 named GLM from z.ai and one named Claude. Those credit lines describe researcher submissions; they do not identify Microsoft’s internal tools or establish how many of the month’s fixes AI helped discover.
““Advanced AI models are part of the discovery picture and help to accelerate it.””
— Microsoft Security Response Center vice president of engineering Tom Gallagher, in a May post
What the Counts Do Not Show
Microsoft has not said how many of November’s fixes came from AI discovery, either through its own tools or outside researchers. The 24 credited researcher submissions in the source’s review do not resolve that question: credits identify some external work, not the origin of every vulnerability.
The source reports that the Outlook flaw was exploited before the fix, and CISA added it to its exploited-flaw catalog. The available material does not say how many attacks occurred, who carried them out, which organizations were affected or whether the disclosed hash exposure led to account compromise. Those details remain unknown.
A separate Paint flaw, CVE-2026-83844, also has unresolved patch availability. It was published on October 13. Heise reported that the version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, while PC Gamer reported that some users still could not see it. The source does not establish how widespread the issue is or when it will reach all users.
Outlook and Paint Update Checks
Administrators should review Microsoft’s November advisories, prioritize the Outlook fix for CVE-2026-124194, then assess the Critical server flaws against their own deployments. Patch order will depend on exposure, installed products and the organization’s maintenance process; the release count by itself does not determine local priority.
Paint requires a separate check. Users and administrators can look for version 11.2609.401.0 through the Microsoft Store, while recognizing that the source reports it may not yet appear for some users. Microsoft has not provided, in the supplied material, a schedule for wider availability. The next useful updates will be confirmation of distribution and any further details about exploitation or affected users.
Key Questions
How many Microsoft CVEs are in the November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 vulnerabilities first published that day; the source attributes the one-item difference to an Entra Device Registration flaw published five days earlier.
Which flaw was reported as exploited?
CVE-2026-124194 affects Outlook. Microsoft says opening a crafted file can expose a user’s NTLMv2 password hash. CISA added the flaw to its catalog of known exploited vulnerabilities on November 10.
Does the release show how many fixes came from AI?
No. Microsoft has said AI is one part of vulnerability discovery, alongside automation and outside researchers, but has not quantified its role in the November fixes. Researcher credit lines in the source’s review do not reveal Microsoft’s internal discovery methods.
What should users check for the Paint vulnerability?
The source identifies version 11.2609.401.0 as the working version for CVE-2026-83844 and says it can be checked through the Microsoft Store. It also reports that some users could not yet see that version.
Source: Thorsten Meyer AI
