🔍 Read the full analysis: Microsoft’s Patch Tuesday Fixes 1,094 Issues, Including One Under Attack on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, and one Outlook vulnerability, CVE-2026-124194, was exploited before a fix was available. The company rates the flaw Moderate, but says a crafted file can expose a user’s NTLMv2 password hash; CISA added it to its exploited-vulnerabilities catalog on November 10.
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that was exploited before its fix was available. Microsoft rates the Outlook flaw, CVE-2026-124194, Moderate, but says opening a specially crafted file can expose a user’s NTLMv2 password hash; the Cybersecurity and Infrastructure Security Agency added it to its exploited-vulnerabilities list on November 10.
The Outlook issue is the release’s only flaw marked “Exploitation Detected” in Microsoft’s data, according to the source report. Microsoft’s description says an unauthenticated attacker could send a specially crafted file that, when opened, leaks the user’s NTLMv2 password hash. The source material does not provide further details about the attacks, affected organizations or how the vulnerability was used.
The headline count refers to Microsoft’s own vulnerabilities, not simply every vendor’s issue included in Microsoft’s security data. A review of the Security Update Guide data described in the source found 1,095 entries naming Microsoft as issuer, less one Edge entry, matching the 1,094 in Microsoft’s release notes. Krebs on Security counted 1,093 fixes published November 10; the one-entry difference is CVE-2026-109469, an Entra Device Registration flaw published November 5. Microsoft classifies that issue as Critical and says customers do not need to take action.
Microsoft’s release notes assign 726 CVEs to Windows and 174 to Office. The remaining listed groups include SQL Server, with 59; Developer Tools, 53; SharePoint Server, 27; other products, 25; Azure, 20; Exchange Server, nine; and Defender, one. These categories describe Microsoft’s product breakdown, not a count of distinct attacks or affected customers.
Microsoft fixes 1,094 issues One Outlook flaw was exploited
Microsoft’s November 10 release includes an Outlook vulnerability exploited before a fix was available. The report says the flaw can expose a user’s NTLMv2 password hash when a crafted file is opened.
Why Outlook needs attention
The Moderate rating and evidence of exploitation describe different things; organizations should review exposure and patch status.
Confirm affected installations have received the relevant updates.
Assess applicable Critical server flaws against your systems and Microsoft’s advisories.
CISA added the Outlook vulnerability to its exploited-vulnerabilities catalog on November 10.
Where the fixes are concentrated
Microsoft’s release notes break down CVEs by product group.
A count is not a risk score
Monthly CVE totals changed sharply, but counts alone do not measure customer risk, exposure or attack frequency.
- 63 Microsoft CVEs listed
- 1,094 Microsoft CVEs listed
- The report says the larger total does not establish proportionally higher risk.
What remains unclear
Available reporting does not describe the attack targets, number of attacks or whether exploitation continues.
The Outlook Flaw Needs Early Attention
The exploited Outlook issue merits attention even though its Moderate rating and 6.5 CVSS score are below the release’s Critical ratings. A flaw’s severity rating and evidence of exploitation convey different information: the rating estimates severity under a scoring system, while Microsoft’s “Exploitation Detected” label signals reported use by attackers. CISA’s addition of the vulnerability to its catalog is a further reason for organizations to review their exposure and patch status.
For administrators, the scale of the release also makes prioritization practical rather than optional. The source report recommends addressing Outlook and Office updates first, then reviewing the Critical server vulnerabilities that apply to each organization’s systems. That is guidance from the report, not a substitute for an organization’s own risk assessment or Microsoft’s specific product instructions.
The four-digit count also draws attention to how Microsoft’s vulnerability-disclosure workload is changing. The source’s year-over-year comparison is 1,094 CVEs in November 2026 versus 63 in November 2025. A larger count does not, by itself, establish that customers face a proportionally higher risk: the number of flaws identified as exploited remained much smaller, and vulnerability counts do not measure severity, exposure or attack frequency.
Popular right now
Ninja Luxe Café Mini Plus Espresso and Coffee Maker with AutoFroth, Bone & Champagne
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
A Sharp Rise in Microsoft’s CVE Counts
Microsoft’s release notes show a steep increase in monthly counts over the period covered by the source report. The report lists 220 Microsoft CVEs in June 2026, 663 in July, 999 in September and 1,474 in October, followed by 1,094 in November. It calculates the November count as about 17 times the 63 listed for November 2025. That comparison is between monthly CVE counts, not a measure of risk or the number of attacks.
Microsoft has linked its larger vulnerability discoveries in part to AI-assisted security research, while also naming automation and wider participation by outside researchers. In a May post, Microsoft Security Response Center engineering vice president Tom Gallagher said advanced AI models were “part of the discovery picture” and that releases could “continue trending larger for some time.” The company also said the increase was not driven by any one model or change.
The November data does not establish how much of the increase came from AI. The source report found 24 November entries whose credit lines said a researcher worked using an AI model: 23 named GLM from Z.ai and one named Claude. Those acknowledgments identify some researchers’ tools, but they do not reveal Microsoft’s internal methods or quantify AI’s role across the release.
Attack Scope and Paint Status Remain Unclear
Microsoft’s exploitation label and CISA’s catalog entry establish that the Outlook flaw was reported as exploited, but the available source material does not say who was targeted, how many attacks occurred or whether exploitation continues. It also does not provide the full text of Microsoft’s attack description, which is cut off in the supplied material. No affected-customer count is given.
A separate Paint issue, CVE-2026-83844, has a reported update problem. According to the source, Microsoft published the flaw October 13; the version it first identified as fixed remained vulnerable, according to German technology publication heise. The source says version 11.2609.401.0 was named on November 6, while PC Gamer reported that the version still was not appearing for some users. The material does not establish how widespread that availability issue is or whether Microsoft has since resolved it.
There is also a small difference in published counts because the source compares separate reporting dates: Krebs counted 1,093 issues published November 10, while Microsoft’s notes list 1,094. The source attributes the extra item to a Microsoft flaw published five days earlier. Readers should not treat these figures as evidence that one count includes hundreds of third-party vulnerabilities; the source’s reconciliation distinguishes Microsoft’s entries from other vendors’ listings.
Check Outlook, Office and Paint Updates
Organizations should review Microsoft’s November security guidance and confirm whether affected Outlook and Office installations have received the relevant updates. Administrators can then assess the Critical server flaws against their own systems, using Microsoft’s product-specific advisories rather than relying only on the overall CVE total. CISA’s exploited-vulnerabilities listing gives defenders another source to consult when setting patch priorities.
For Paint, the source recommends checking the Microsoft Store for the reported working version, 11.2609.401.0, and verifying the installed version rather than assuming the initial fix description settled the issue. The available reporting does not set out a deadline for a further Paint update or describe a confirmed resolution for users who cannot see that version.
Microsoft’s monthly release notes and subsequent advisories will show whether the company adds clarifications, and further reporting may establish the scope of exploitation and Paint availability. Until those details are confirmed, users and administrators should rely on current vendor guidance and their own patch-management processes.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the source report says the difference is one Microsoft flaw published on November 5.
Which vulnerability was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is the release’s only issue marked “Exploitation Detected” in the data described by the source. Microsoft rates it Moderate and says a crafted file can expose an NTLMv2 password hash.
Does the 1,094 figure mean 1,094 flaws were exploited?
No. It is the number of Microsoft CVEs listed in the release, not the number of exploited flaws. The source identifies one November issue as marked “Exploitation Detected.”
Did AI cause the large number of fixes?
Microsoft says AI-assisted discovery is one part of a broader picture that also includes automation and more outside research. It has not said how many of November’s fixes came from AI; the researcher credit lines in the data do not establish the role of Microsoft’s internal tools.
What should users check first?
The source report advises prioritizing Outlook and Office updates, then checking applicable Critical server fixes. It also advises checking Paint through the Microsoft Store because the source reports that the corrected version was not appearing for some users.
Source: ThorstenMeyerAI.com
