Read the full analysis: Which Microsoft Flaw Is Under Attack? Patch Tuesday Fixes 1,094 Issues on ThorstenMeyerAI.com
TL;DR
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, and the company says one Outlook vulnerability, CVE-2026-124194, was exploited before a fix was available. The flaw is rated Moderate, but opening a crafted file can expose an NTLMv2 password hash. Microsoft has linked its growing volume of fixes partly to AI-assisted discovery, but has not said how many November vulnerabilities AI helped find.
Microsoft’s November 10 Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says attackers exploited before a fix was available. The flaw, CVE-2026-124194, is rated Moderate, but Microsoft says opening a specially crafted file can expose a user’s NTLMv2 password hash; the scale of the monthly release also renews questions about why Microsoft’s published vulnerability counts have risen so sharply.
Microsoft’s Security Update Guide calls the November release a set of 1,094 Microsoft CVEs. Krebs on Security reported 1,093 fixes published on November 10. The source analysis attributes the one-entry difference to CVE-2026-109469, a Critical Entra Device Registration flaw Microsoft published November 5 and for which it says customers need take no action. The underlying data also contains vulnerabilities from other vendors, but the source’s count separates those from Microsoft’s entries.
The release notes divide the fixes across product families, with 726 for Windows and 174 for Office, followed by SQL Server, Developer Tools, SharePoint Server, Azure, Exchange Server, other products and Defender. The most urgent item identified in the report is not one of the flaws rated Critical: CVE-2026-124194 is an Outlook spoofing vulnerability rated Moderate, with a CVSS score of 6.5. Microsoft marks it as having “Exploitation Detected.”
According to the source material, opening a crafted file can leak a victim’s NTLMv2 password hash. The report says the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10. Microsoft released a fix with the monthly update. The information provided does not specify the attackers, the number of victims or the extent of any confirmed campaigns.
Which Microsoft Flaw Is Under Attack? Patch Tuesday Fixes 1,094 Issues
Microsoft reports that attackers exploited an Outlook flaw before a fix was available. Its Moderate rating makes the case for prioritizing patches by exploitation evidence, not severity alone.
Prioritize the exploited Outlook flaw
CVE-2026-124194 was marked “Exploitation Detected” and rated Moderate.
Opening a crafted file can expose a user’s NTLMv2 password hash.
Prioritize Critical server vulnerabilities that apply to your systems.
Check devices rather than relying only on automatic update settings.
The monthly count has risen sharply
Microsoft’s published CVE counts vary month to month and do not measure risk to a particular network.
What the count does—and doesn’t—show
Microsoft cites AI-assisted discovery, automation and wider researcher participation as factors in larger releases.
24 November entries credited researchers with AI model use.23 named GLM from z.ai; one named Claude.
Microsoft has not said how many November flaws AI helped find.Research credits do not establish AI’s share of the total.
Check the separate Paint update
Reports described uneven availability of the version identified as working.
Check the installed Paint version through the Microsoft Store.Compare it with version 11.2609.401.0.Confirm the update is present instead of assuming it arrived automatically.
Prioritize the Exploited Outlook Fix
The Outlook issue shows why a high severity label alone is not a reliable way to prioritize patching. Although Microsoft rates it Moderate, it is the release’s identified flaw with exploitation detected, and the reported consequence involves exposure of a password hash. Organizations should give the Outlook and related Office update prompt attention, particularly where users handle files from untrusted sources.
The sheer count matters for administrators who must test and deploy updates across different systems. Microsoft’s own release notes list more than a thousand CVEs, but that does not mean every organization is exposed to every issue or that all fixes have equal urgency. The source recommends patching Outlook and Office first, then reviewing Critical server flaws relevant to each organization’s environment. The separate Paint issue also calls for a distinct version check rather than assuming every update has arrived automatically.
A Sharp Rise in Monthly CVE Counts
The November total is large compared with the same month a year earlier. The source’s review of Microsoft’s monthly release notes found 63 Microsoft CVEs in November 2025 and 1,094 in November 2026. It also reports 1,474 in October 2026, 999 in September and 663 in July. Those are counts of published CVEs, not a measure of how many are exploitable in a particular network or how many have been attacked.
Microsoft has offered several explanations for the rise. In an April statement, MSRC engineering vice president Tom Gallagher said AI can help discover more issues across a broader surface area. In May, Microsoft said advanced AI models are part of its discovery process, while also pointing to improved automation and wider participation by outside researchers. The company expects releases to remain larger for some time and said the change is not driven by one model or one development.
The source’s review found that 24 November entries credited researchers with using an AI model: 23 named GLM from z.ai and one named Claude. The exploited Outlook flaw’s credit line names Benoît Sevens using Claude with Anthropic, as well as a second researcher listed as “nono.” These credits concern reported research contributions; they do not establish how much AI contributed to Microsoft’s internal security work or to the month’s overall total.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
AI’s Share and Attack Scope
Microsoft has not reported how many of November’s CVEs were found with AI, including how much its internal tools contributed. Researcher credit lines identify some AI use but cannot establish the share of the total caused by AI. The count alone also does not explain whether the increase reflects more flaws discovered, changes in reporting practices, or a combination of factors.
Details of exploitation for the Outlook flaw remain limited in the source material. It does not identify the attackers, affected organizations, dates or scale of observed attacks. CISA’s addition of the CVE to its exploited-vulnerability catalog signals that it is treated as exploited, but does not, by itself, provide those campaign details.
A separate Paint vulnerability, CVE-2026-83844, adds an update-status concern. The source says Microsoft first named a Paint version as fixed, but the German publication heise reported that version remained vulnerable. A working version, 11.2609.401.0, was named November 6; PC Gamer reported it had not appeared for some users. The supplied information does not establish how widely the affected version remains available or the current status for every user.
Apply Updates and Check Paint
Organizations should review Microsoft’s November security guidance against the software they operate, deploy the Outlook and Office fixes promptly, and prioritize Critical server vulnerabilities that apply to their systems. Administrators should confirm that updates have installed rather than relying only on a device’s automatic update setting. Microsoft has not provided a single risk ranking that applies to every organization’s configuration.
For Paint, users and administrators can check the installed version through the Microsoft Store and compare it with the reported working version, 11.2609.401.0. Because reports described uneven availability, a version check may be more informative than assuming the update is present. Further details on exploitation, patch availability and Microsoft’s use of AI may emerge through vendor guidance, CISA updates and subsequent reporting.
Key Questions
Which Microsoft flaw was reported as exploited?
CVE-2026-124194, a Microsoft Outlook spoofing vulnerability, is the flaw marked “Exploitation Detected” in the November release, according to the source material.
What can the Outlook vulnerability expose?
The report says opening a specially crafted file can expose a user’s NTLMv2 password hash. Microsoft rates the vulnerability Moderate and gives it a CVSS score of 6.5.
Why does the November release list 1,094 CVEs while Krebs reports 1,093?
The source attributes the difference to CVE-2026-109469, published November 5 rather than on Patch Tuesday. Microsoft says customers do not need to take action on that Entra Device Registration flaw.
Did AI find all or most of the November vulnerabilities?
That is not known. Microsoft says AI is part of its vulnerability-discovery process, but it has not stated how many of November’s fixes came from AI. Researcher credit lines identify some AI-assisted research but do not measure Microsoft’s internal use.
What should users do about the Paint flaw?
Check Paint’s installed version through the Microsoft Store. The source identifies version 11.2609.401.0 as the working version but reports that availability was uneven; users should verify the version rather than assume the fix has arrived.
Source: ThorstenMeyerAI.com