TL;DR
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including one Outlook vulnerability that was exploited before a fix was available. Microsoft has linked larger releases to broader vulnerability discovery, including AI-assisted research, but has not said how many November fixes involved AI. A separate Paint flaw has prompted reports that the named fix may not reach all users.
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability, CVE-2026-124194, that was exploited before a fix was released, according to the source material. The flaw can expose a user’s NTLMv2 password hash when they open a crafted file, making the update especially relevant to Outlook and Office users and administrators.
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
Microsoft’s Security Update Guide release notes give the November total as 1,094 Microsoft CVEs. The source material says security news outlet Krebs on Security counted 1,093 vulnerabilities published on November 10; the one-count difference is CVE-2026-109469, an Entra Device Registration issue Microsoft published on November 5. Microsoft says no customer action is needed for that earlier issue. The source says its count excludes flaws attributed to other vendors that Microsoft republishes, such as Chrome vulnerabilities also affecting Edge.
The exploited Outlook issue is CVE-2026-124194. According to the source material, opening a crafted file can expose a user’s NTLMv2 password hash. The Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10. The material advises applying Outlook and Office updates first, then reviewing the release’s Critical server flaws against the systems in use.
The release total is below October 2026’s 1,474 CVEs but far above the 63 listed for November 2025. The source’s month-by-month count puts January through November 2026 at 5,523 Microsoft CVEs. Separately, the material reports a Paint vulnerability, CVE-2026-83844, published October 13: the initially named fixed version was reportedly still vulnerable, and a later version number, 11.2609.401.0, may not yet be appearing for some users.
Prioritize the Exploited Outlook Flaw
The Outlook vulnerability changes the immediate priority for organizations managing Microsoft updates. A flaw reported as exploited before patching deserves prompt attention, particularly on systems where Outlook users may open files from outside the organization. The source material describes possible exposure of an NTLMv2 password hash; it does not provide details about the scale of exploitation or the affected victims.
The four-digit monthly count also creates a workload issue for security teams. Microsoft’s release spans Windows, Office, SQL Server, developer tools, SharePoint Server, Azure and other products. Administrators need to identify which updates apply to their environments and sequence deployment around risk and operational impact. A high count alone does not mean every vulnerability presents the same level of urgency.
For individuals, the reported Paint issue is a reminder to check the installed app version rather than assume that a published fix has reached every device. The source says the working version may not appear for some users, but does not establish how widespread that delay is.
Popular right now
iRobot Roomba Plus 405 (G181) 2-in-1 Vacuum and Mop Robot with AutoWash Dock
Dyson V8 Motorhead Origin Cordless Vacuum
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
As an affiliate, we earn on qualifying purchases.
How Microsoft Counts November Fixes
The November total is part of a sharp rise in Microsoft’s published CVE counts during 2026. According to the source’s review of Microsoft Security Update Guide data, monthly totals included 220 in June, 663 in July, 999 in September and 1,474 in October. The source describes November’s count as about 17 times November 2025’s 63, using the same release-note basis. These are counts of listed CVEs, not a direct measure of how many attacks occurred or how severe the vulnerabilities were.
Microsoft has said that advanced AI models contribute to vulnerability discovery, alongside automation and outside research. In a May statement quoted in the source, Microsoft Security Response Center vice president Tom Gallagher said, “Advanced AI models are part of the discovery picture and help to accelerate it.” He also said the company expected releases “to continue trending larger for some time.” Microsoft has not disclosed what share of November’s fixes came from AI-assisted work.
The source’s review found that 24 of the 1,093 CVEs published on November 10 credited researchers as using an AI model: 23 entries named GLM from z.ai and one named Claude. Those credits refer to credited research and do not reveal Microsoft’s internal tools or establish how AI contributed to the full release.
What the Counts Do Not Show
Microsoft has not said how many November vulnerabilities were found with its own AI tools, or how much AI contributed to the overall release. Researcher credit lines provide only limited information and cannot establish the role of internal discovery methods.
The source material reports that the Outlook flaw was exploited before patching and that CISA added it to its exploited-vulnerability catalog, but it does not identify the attackers, affected organizations, number of victims or duration of exploitation. It also does not provide technical detail on the campaign.
The status of the Paint fix remains unsettled in the supplied reporting. The source says the initially named version remained vulnerable, while a later version was identified on November 6 and reportedly had not appeared for some users. The number of affected users and Microsoft’s response to those reports are not specified.
Check Outlook and Paint Updates
Organizations should check Microsoft’s November security guidance for updates that apply to their products, prioritize the Outlook fix for CVE-2026-124194, and review the release’s Critical server issues against their deployments. The source material also recommends checking Paint separately through the Microsoft Store and confirming the installed version, given reports that the later version may not yet be visible to all users.
Further clarity would come from Microsoft confirming the status and availability of the Paint update, and from additional reporting on the Outlook exploitation campaign. Microsoft’s future release notes may also show whether the elevated CVE counts continue, but the November data alone cannot establish how long that pattern will last.
Key Questions
How many Microsoft CVEs are listed in the November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source material attributes the one-count difference to an Entra Device Registration flaw published on November 5.
Which vulnerability was reported as exploited?
The source material identifies CVE-2026-124194 in Outlook. It says opening a crafted file can expose a user’s NTLMv2 password hash and that CISA added the flaw to its exploited-vulnerability catalog on November 10.
Did AI find most of the November vulnerabilities?
The available information does not establish that. Microsoft has said AI contributes to vulnerability discovery, but has not reported what share of November’s fixes involved AI. The source review found 24 researcher credit lines naming an AI model among 1,093 entries published on November 10.
Is the Paint vulnerability fixed for everyone?
That is unclear from the source material. It reports that the initially named fixed version remained vulnerable and that version 11.2609.401.0 was later named, but some users reportedly could not see that version. Users can check Paint’s version and update availability through the Microsoft Store.
Source: Thorsten Meyer AI
