🔍 Read the full analysis: Microsoft’s Patch Tuesday Security Fixes Include An Attacked Flaw And Paint on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says was exploited before a fix was available. A separate Paint vulnerability has a reported patch-version issue, and some users may not yet see the working update.
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company marked as exploited before a fix was available. The release also arrives amid reports that Microsoft’s update for a separate Paint vulnerability was initially identified incorrectly and may not yet be available to some users.
The Outlook issue, CVE-2026-124194, is a spoofing vulnerability rated Moderate by Microsoft, with a CVSS score of 6.5. Microsoft’s release data marks it “Exploitation Detected.” The source report says opening a crafted file can expose a user’s NTLMv2 password hash; the available material does not provide further details about the attacks or their targets. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its list of exploited vulnerabilities on November 10.
The release’s headline count differs slightly across sources. Microsoft’s release notes say 1,094 CVEs; Krebs on Security counted 1,093 vulnerabilities published on November 10. The source report attributes the one-entry gap to CVE-2026-109469, a Critical Entra Device Registration flaw published November 5. Microsoft says no customer action is needed for that issue. The report says the 1,094 figure counts Microsoft-issued vulnerabilities rather than bugs from other vendors that also appear in Microsoft’s data.
The Paint issue is CVE-2026-83844, published October 13. According to the source report, German publication heise found that the Paint version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6. PC Gamer reported that the version was still not appearing for some users. Those reports concern the Paint fix, separately from the November release’s exploited Outlook flaw.
Patch Tuesday fixes an attacked flaw and a Paint update issue
Microsoft’s November release includes an Outlook vulnerability marked as exploited. Reports also say some users may not yet have the working Paint fix.
The two updates to check
The Outlook and Paint issues call for different checks.
Exploitation detected
CVE-2026-124194 is rated Moderate. A crafted file can expose an NTLMv2 password hash.
Confirm the app version
The reported working fix is version 11.2609.401.0. Some users may not yet see it.
Check devices and prioritize
Use the products in your environment to guide deployment.
Check Microsoft’s guidance and prioritize relevant updates.
Review fixes for the server products you use.
Check the Microsoft Store and confirm the installed version.
What the release count means
A large CVE count does not measure attack activity or risk to every customer.
Prioritize Outlook and Paint Updates
The Outlook flaw stands out because Microsoft reports exploitation before the fix, even though its severity rating is Moderate rather than Critical. That makes the exploitation status relevant to administrators deciding which updates to test and deploy first. CISA’s listing provides a further public indication that the vulnerability is being treated as exploited, but the source material does not describe the scope of attacks or identify victims.
The Paint reports present a different kind of risk: uncertainty over whether users have received a version that addresses the flaw. Users and IT teams should verify the installed version rather than assume that an update prompt or an earlier version number means the vulnerability has been resolved. The source report recommends prioritizing Outlook and Office updates, then reviewing Critical server fixes according to the products in use, and checking Paint separately through the Microsoft Store.
The release’s size also matters for security teams managing testing and deployment. A large number of listed fixes can require more work to assess, but the CVE count does not itself show how many issues are actively attacked. In the source report’s review of Microsoft data, the monthly number flagged as exploited ranged from zero to six; November had one. The count of vulnerabilities and the count of known exploitation are different measures.
Products Worth Considering
BowFlex SelectTech 840 Adjustable Kettlebell
Philips Sonicare ProtectiveClean 5300 Rechargeable Electric Toothbrush with 3 Brush Heads, Black
Withings Body Scan Smart Scale with Segmental Body Composition and ECG, Black
As an affiliate, we earn on qualifying purchases.
How the November Count Was Tallied
Microsoft’s November release is part of a sharp increase in the number of vulnerabilities listed in its monthly security data. The source report says Microsoft listed 63 CVEs in November 2025, compared with 1,094 in November 2026. It also records 1,474 for October 2026. These figures describe the source’s count of Microsoft CVEs in the relevant monthly releases; they do not establish how many flaws affect a typical customer or how many require the same response.
Microsoft has previously said that several factors contribute to larger releases. In May, Tom Gallagher, a Microsoft Security Response Center engineering vice president, wrote that advanced AI models are part of vulnerability discovery. He also cited more mature automation tools and broader participation by outside researchers, and said Microsoft expected releases to keep growing for some time. The source report says 24 November entries credited researchers using an AI model, but those public credit lines do not show how much AI Microsoft used internally or what share of the release it helped find.
Microsoft’s product-family breakdown assigns most of the November count to Windows, with 726 CVEs. The release notes also list 174 for Office, 59 for SQL Server, 53 for Developer Tools, 27 for SharePoint Server, 25 for other products, 20 for Azure, nine for Exchange Server and one for Defender. These counts indicate where vulnerabilities were listed, not a measure of relative risk or the number of affected organizations.
““This release consists of 1094 Microsoft CVEs.””
— Microsoft, as quoted in its November release notes
Attack Scope and Patch Availability
The source material does not establish how many attacks used CVE-2026-124194, who was targeted, or whether the reported hash exposure led to account compromise. Microsoft’s “Exploitation Detected” flag and CISA’s listing confirm the vulnerability is treated as exploited, but do not answer those questions.
It is also unclear how widely the corrected Paint version has been distributed or which users still cannot access it. The source material cites reporting that version 11.2609.401.0 is the working fix and that some users do not see it, but provides no Microsoft statement explaining the rollout status. Microsoft has not quantified how many November vulnerabilities were discovered with AI, and researcher credit lines cannot show the company’s internal tools or methods.
Verify the Fixes on Affected Devices
Organizations should review Microsoft’s November security guidance against the products and systems they operate, with particular attention to Outlook and Office and any relevant Critical server vulnerabilities. Administrators can check Microsoft’s updates for deployment instructions and determine whether the fix has reached their managed devices.
For Paint, users and support teams can check the Microsoft Store and confirm whether the installed app is version 11.2609.401.0, the version identified in the source report as working. Further clarification from Microsoft on availability, the Outlook attack activity, or its use of AI in vulnerability discovery would help answer the remaining questions. The source material does not give a date for such updates.
Key Questions
What did Microsoft release on November 10, 2026?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published that day; the source report says the difference is a Critical Entra Device Registration flaw published five days earlier.
Which November vulnerability was reported as exploited?
CVE-2026-124194, an Outlook spoofing vulnerability rated Moderate by Microsoft, is marked “Exploitation Detected.” The source report says a crafted file can expose an NTLMv2 password hash, and notes that CISA added the flaw to its exploited-vulnerabilities list on November 10.
What is the issue with the Paint update?
The source report says the Paint version initially identified by Microsoft as fixed was still vulnerable, according to heise. Microsoft named version 11.2609.401.0 on November 6; PC Gamer reported that some users still could not see it.
Does the large CVE count mean every listed flaw is being attacked?
No. The count measures vulnerabilities in the release, not active attacks. The source report says one November flaw was marked exploited and that monthly exploited counts in its review ranged from zero to six.
How much of the release was found using AI?
Microsoft has said AI contributes to vulnerability discovery, but has not stated how many November fixes came from AI. The source report found AI-related researcher credit on 24 entries; those credits do not reveal Microsoft’s internal use of AI.
Source: ThorstenMeyerAI.com
