🔍 Read the full analysis: Microsoft Patch Tuesday Fixes 1,094 Flaws, Including One Under Attack And A Paint Bug on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that was exploited before a fix became available. A separate Paint flaw remains a concern because the first version Microsoft identified as fixed was reportedly still vulnerable, and the corrected version may not yet be available to all users.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook flaw that attackers exploited before a patch was available. The release also comes amid reports that a fix for a separate Paint vulnerability was initially incomplete and that the corrected version is not yet appearing for some users.
The exploited issue is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability that Microsoft rates Moderate, with a CVSS score of 6.5. Microsoft says an attacker could use a specially crafted file to expose a victim’s NTLMv2 password hash. The Cybersecurity and Infrastructure Security Agency added the flaw to its list of exploited vulnerabilities on November 10, according to the source report. The supplied material does not describe the scale or targets of attacks.
Microsoft’s release notes state that the November update consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 flaws published on November 10; the discrepancy is one Entra Device Registration issue, CVE-2026-109469, which Microsoft published on November 5 and says requires no customer action. The source’s review of Microsoft’s machine-readable data says the total excludes vulnerabilities credited to other vendors.
A separate issue concerns Paint CVE-2026-83844, published October 13. The source report, citing German technology publication heise, says the Paint version Microsoft first named as fixed remained vulnerable. Microsoft identified version 11.2609.401.0 as the working version on November 6, but PC Gamer reports that it is still not appearing for some users. This Paint problem is distinct from the exploited Outlook vulnerability.
Microsoft’s November Patch Tuesday Fixes 1,094 Flaws
One Outlook flaw was exploited before a fix was available. A separate Paint fix may still be missing for some users.
Prioritize the Outlook fix
CVE-2026-124194 was exploited before a patch was available.
The flaw could expose a victim’s NTLMv2 password hash through a specially crafted file.
Check Critical vulnerabilities against the systems and services your organization uses.
Apply relevant updates using your normal testing and rollout process.
Check Paint separately
The Paint issue is distinct from the exploited Outlook flaw.
- The first version named as fixed reportedly remained vulnerable.
- Microsoft identified version 11.2609.401.0 as working on November 6.
- Check Microsoft Store for version 11.2609.401.0.
- If it is unavailable, check Microsoft’s update information for guidance.
Put the count in context
The total counts disclosed CVEs, not affected customers or attacks.
| Release detail | Count | What it means |
|---|---|---|
| Microsoft release notes | 1,094 | Includes an Entra issue published November 5 |
| Count published November 10 | 1,093 | One fewer than Microsoft’s release total |
| Office CVEs | 174 | Part of the November release |
Prioritize Outlook and Paint Updates
The Outlook flaw warrants prompt attention because it was exploited before the fix, even though Microsoft’s severity rating is Moderate. The report says a crafted file can expose an NTLMv2 password hash, making the issue relevant to users and organizations that rely on Outlook and Windows authentication. Microsoft’s rating and the confirmed exploitation flag describe different aspects of risk; the rating alone does not establish whether an individual user has been targeted.
The release’s size also affects how administrators plan update work. The source recommends patching Outlook and Office first, then reviewing Critical server vulnerabilities that apply to each organization’s systems. Paint should be checked separately through the Microsoft Store because the corrected version may not have reached every user. The large CVE total does not mean every listed flaw affects every device or carries the same urgency.
Microsoft’s own figures show a marked rise in published fixes, but the source’s monthly review says the number of flaws flagged as exploited remained between zero and six per month, with one in November. That distinction helps keep the overall count in perspective: more disclosed fixes do not by themselves indicate a matching rise in active attacks.
Popular right now
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701
Dyson Airwrap i.d. Multi-Styler for Straight and Wavy Hair
eufy E15 Gen 2 Wire-Free Robotic Lawn Mower
As an affiliate, we earn on qualifying purchases.
A Larger Microsoft Patch Roll
The source compares Microsoft’s November 2026 count with 63 Microsoft CVEs in November 2025. It reports that monthly totals rose during 2026, reaching 1,474 in October before falling to 1,094 in November. Those figures come from Microsoft’s Security Update Guide release notes and data files, as analyzed by Thorsten Meyer. They are counts of CVEs, not a measure of how many customers were affected or how many attacks occurred.
Microsoft has attributed larger releases in part to advances in vulnerability discovery. In an April statement cited by the source, Microsoft Security Response Center engineering vice president Tom Gallagher said AI can identify issues “more quickly” and across a “broader surface area.” In May, Gallagher said advanced AI models were “part of the discovery picture,” while also pointing to improved automation and broader participation by outside researchers. Microsoft has not said how many of November’s fixes resulted from AI.
The source identifies 726 Windows CVEs and 174 Office CVEs in the November release, with the rest covering product groups including SQL Server, developer tools, SharePoint Server, Azure, Exchange Server and Defender. It also notes that 24 November entries credited researchers who used an AI model; those external credit lines do not reveal how Microsoft used AI internally.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 10, 2026 release notes
Attack Scope and Paint Availability
The available source material does not establish who was targeted or how many attacks involved the Outlook flaw, or whether any customers suffered confirmed compromise. It also does not include the full technical description from Microsoft’s advisory; the quoted attack explanation in the source ends mid-sentence. The CVSS score and the exploitation flag are reported, but they do not answer those questions.
For Paint, the source reports that version 11.2609.401.0 was named as the working version and that some users could not yet see it. It does not give Microsoft’s explanation for the distribution gap, confirm how many users are affected, or provide a later statement resolving the reports. The number of November fixes attributable to AI also remains unknown; researcher credit lines are not a full account of Microsoft’s internal discovery work.
Apply Fixes and Check Paint
Users and administrators should consult Microsoft’s security advisories and apply the November updates relevant to their devices. The source recommends giving Outlook and Office fixes priority, then checking Critical server vulnerabilities against the software and services in use. Organizations should follow their normal testing and deployment procedures while accounting for the reported pre-patch exploitation of CVE-2026-124194.
Paint users can check for the reported corrected version, 11.2609.401.0, through the Microsoft Store. If it is not available, the source offers no confirmed rollout timetable; users should check Microsoft’s update information for subsequent guidance. Further information is also needed from Microsoft or security researchers about the Outlook attack activity and the distribution of the Paint fix.
Key Questions
How many flaws did Microsoft list in the November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source attributes the difference to an Entra Device Registration flaw published five days earlier.
Which November flaw was exploited before its fix?
CVE-2026-124194, an Outlook spoofing vulnerability, is the flaw the source says was exploited before a patch. Microsoft rates it Moderate and says a crafted file can expose an NTLMv2 password hash.
Is the Paint vulnerability fixed?
The source says Microsoft identified Paint version 11.2609.401.0 as the working version on November 6, after the first version named as fixed was reportedly still vulnerable. It also cites reports that the corrected version was not appearing for some users.
Did AI account for the increase in Microsoft’s fixes?
Microsoft has said AI contributes to vulnerability discovery, alongside automation and outside research. It has not stated how many of November’s fixes came from AI, and researcher credit lines do not show the extent of Microsoft’s internal use.
Source: ThorstenMeyerAI.com
