TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft’s November 10 security release lists 1,094 Microsoft CVEs, following 1,474 in October. One Outlook vulnerability, CVE-2026-124194, was exploited before Microsoft issued a fix; CISA added it to its exploited-vulnerabilities list on November 10. Microsoft has linked larger releases partly to improved vulnerability discovery, including AI, but has not said how much AI contributed to this month’s total.
Microsoft’s November 10, 2026 security release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that was exploited before a fix became available. The flaw, CVE-2026-124194, can expose a user’s NTLMv2 password hash when the user opens a crafted file, according to the supplied report; CISA added it to its list of exploited vulnerabilities on November 10.
The release is the second consecutive four-digit monthly count: Microsoft listed 1,474 CVEs in October. Its November release notes say the release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 fixes published that day, because its count excludes a separate cloud vulnerability that Microsoft published five days earlier.
The underlying Microsoft Security Update Guide data file contains entries from other vendors as well as Microsoft. The report’s count method says the file has 1,342 entries, of which 247 are from other vendors, largely Chrome issues also relevant to Microsoft Edge. Of the remaining entries, one Edge entry is excluded, leaving the 1,094 Microsoft CVEs in the release notes. The separate CVE-2026-109469, a Critical Entra Device Registration flaw published November 5, is not included in the November 10 count; Microsoft says no customer action is needed for it.
For the Outlook flaw, the report identifies researcher Benoît Sevens, who is credited as using Claude with Anthropic, and a second researcher listed as “nono.” The report says Microsoft’s November data marks one flaw as exploited. CISA’s addition of CVE-2026-124194 to its exploited-vulnerabilities list is a separate public indication that the issue had been used in attacks. The supplied material does not detail the attacks or identify affected victims.
Prioritize the Outlook Fix
The large release count may draw attention, but the immediate risk signal is the Outlook vulnerability reported as exploited. A crafted file can expose an NTLMv2 password hash when opened, according to the source material. Organizations that rely on Outlook and Office should check Microsoft’s update guidance and apply the relevant fixes promptly, especially on systems used to handle untrusted files.
Administrators also need to sort the remaining updates by product and exposure. The release notes assign 726 CVEs to Windows and 174 to Office, with additional issues affecting SQL Server, developer tools, SharePoint Server, Azure and Exchange Server. The source recommends addressing the Outlook and Office updates, then reviewing Critical server flaws relevant to each organization’s network. The total alone does not show which products are exposed in a particular environment or which fixes require immediate deployment there.
Microsoft’s monthly data, as counted in the report, shows that the number of flaws flagged as exploited stayed between zero and six per month across the cited months, despite the steep rise in total entries. That comparison describes the report’s count of Microsoft’s “Exploited: Yes” flags; it does not establish that all attacks are known or that unflagged vulnerabilities are safe to defer.
Products Worth Considering
Sonos Arc Ultra Soundbar with Dolby Atmos, Black
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
DJI Mini 3 Drone with DJI RC and 3-Axis Mechanical Gimbal
As an affiliate, we earn on qualifying purchases.
How the Monthly Count Grew
The reported monthly totals show a sharp rise over the year: Microsoft’s November 2025 release notes listed 63 CVEs, compared with 65 in December. The count reached 220 in June 2026, 663 in July, 999 in September and 1,474 in October, before falling to 1,094 in November. Based on those release-note totals, November’s count is about 17 times the November 2025 figure. That comparison is a count of listed CVEs, not a measure of severity or attacker activity.
Microsoft has said several factors contribute to larger releases. In an April post, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, wrote that AI can find more issues more quickly across a broader surface area. Microsoft also said it had early access to Anthropic’s Claude Mythos Preview. In May, Gallagher described advanced AI models as part of the vulnerability discovery process, alongside more mature automation tools and broader participation by outside researchers.
Microsoft said in May that releases were expected to continue growing for some time and that it was not changing its standard for accepting bugs. The November data offers limited detail on AI’s role: 24 of the 1,093 entries published November 10 credit researchers who used an AI model, 23 mentioning GLM from z.ai and one mentioning Claude. Those researcher credit lines do not identify Microsoft’s internal tools or establish what share of the month’s vulnerabilities AI helped find.
““Advanced AI models are part of the discovery picture and help to accelerate it.””
— Microsoft Security Response Center vice president of engineering Tom Gallagher, in a May 2026 post
Questions on Exposure and Paint
The supplied material does not identify the targets, scale or technical details of attacks involving CVE-2026-124194. It also does not say how many of the 1,094 November CVEs were discovered with AI, or how much Microsoft’s own internal tools contributed. Researcher credit lines cover only the credited work and cannot answer that broader question.
A separate Paint issue, CVE-2026-83844, has a reported update-distribution problem. The source says it was published October 13, that the version Microsoft initially named as fixed remained vulnerable according to heise, and that Microsoft named version 11.2609.401.0 as the working version on November 6. PC Gamer reported that the version was still unavailable to some users. The material does not establish how many users remain affected or when the update will reach them.
The November release total also needs careful interpretation: Microsoft lists 1,094 Microsoft CVEs, while Krebs reports 1,093 fixes published on November 10. The one-entry difference is attributed to the November 5 Entra Device Registration flaw. The supplied account says Microsoft requires no customer action for that separate issue.
Check Updates and Availability
Organizations should consult Microsoft’s Security Update Guide for the November fixes, identify affected products in their environments and prioritize the Outlook and Office updates. Administrators can then assess the Critical server issues against their deployments and maintenance plans. The supplied material does not give a single deployment deadline, so organizations will need to follow their own response requirements and Microsoft’s product-specific guidance.
Paint users should check the Microsoft Store for version 11.2609.401.0, the version identified in the source as the working fix for CVE-2026-83844. Availability may vary: the source reports that some users had not received it. Microsoft had not provided a wider availability date in the material supplied.
Further reporting can clarify whether the Paint update has reached affected users, what is known about exploitation of the Outlook flaw and how Microsoft’s monthly totals develop. For now, the confirmed release count and the exploited Outlook vulnerability are the clearest signals for readers and administrators reviewing the November update.
Key Questions
How many Microsoft CVEs are in the November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 fixes published that day, excluding a separate cloud flaw published November 5.
Which November vulnerability was reported as exploited?
The report identifies CVE-2026-124194 in Outlook. It says opening a crafted file can expose a user’s NTLMv2 password hash, and that CISA added the flaw to its exploited-vulnerabilities list on November 10.
Did AI account for the large number of fixes?
Microsoft has said AI is one part of vulnerability discovery, alongside automation and outside researchers. It has not said how many November fixes AI helped identify. The 24 researcher credits mentioning AI do not reveal Microsoft’s internal use of AI tools.
What should Paint users check?
For the separate Paint flaw CVE-2026-83844, the source identifies version 11.2609.401.0 as the working fixed version. It reports that the update was still unavailable to some users, so availability may vary.
Source: Thorsten Meyer AI
