🔍 Read the full analysis: Patch Tuesday Brings 1,094 Microsoft Fixes, Including One For Paint on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, following 1,474 in October. One Outlook vulnerability was marked exploited before its fix; a separate Paint vulnerability has had reports of an affected version remaining vulnerable and the corrected version not reaching some users.
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability the company says was exploited before a fix was available. The update also comes amid reported problems with a separate Paint security fix, making it important for users and administrators to check whether the relevant updates have actually reached their devices.
Microsoft’s Security Update Guide describes the release as consisting of 1,094 Microsoft CVEs. The count is lower than October’s 1,474 but far above the 63 listed for November 2025. Krebs on Security reported 1,093 fixes published on November 10; the source analysis attributes the one-item difference to a separate cloud vulnerability Microsoft published five days earlier.
The Outlook issue is CVE-2026-124194, which Microsoft classifies as a moderate-severity spoofing vulnerability with a CVSS score of 6.5. It is the November release’s only flaw marked “Exploitation Detected”, according to the source material. Opening a specially crafted file could expose a user’s NTLMv2 password hash, and CISA added the vulnerability to its catalog of exploited flaws on November 10.
A separate issue, CVE-2026-83844 in Paint, was published on October 13. Heise reported that the Paint version Microsoft initially identified as fixed remained vulnerable. The corrected version, 11.2609.401.0, was identified on November 6; PC Gamer reported that it was still not appearing for some users. These reports concern a separate Paint update, not the Outlook flaw included among the November fixes.
November Patch Tuesday 1,094 Microsoft fixes
The November 10 release includes an Outlook flaw Microsoft says was exploited before a fix was available. Separate reports raise questions about whether Paint users have received its corrected version.
Prioritize the Outlook flaw
CVE-2026-124194 was the November release’s only flaw marked “Exploitation Detected.”
Already exploited
A specially crafted file could expose a user’s NTLMv2 password hash. CISA added the vulnerability to its exploited-flaw catalog.
Verify the corrected version
Reports say the initially identified Paint fix remained vulnerable. Check the Microsoft Store for version 11.2609.401.0.
Where the fixes are concentrated
The release spans products, so administrators should identify applicable updates for their environments.
Check, install, confirm
A published fix does not confirm that it reached an affected device.
Check applicable updates, especially on systems that open files from untrusted sources.
Identify relevant Critical server fixes and apply them according to exposure and patching procedures.
Check the installed Paint version and look for 11.2609.401.0 in the Microsoft Store.
What the release count means
Microsoft’s listed total varies sharply from month to month.
Prioritize Outlook and Verify Paint
The Outlook vulnerability deserves prompt attention because Microsoft marked it as exploited, and CISA added it to its exploited-vulnerability catalog. Microsoft’s moderate rating and 6.5 CVSS score do not mean the reported attack activity can be ignored: administrators need to weigh that evidence alongside the systems and users exposed in their environments.
The overall CVE count also makes deployment decisions harder. The source’s product breakdown assigns 726 CVEs to Windows, 174 to Office, 59 to SQL Server and 53 to Developer Tools, with additional fixes across other products. That spread means organizations may need to identify which updates apply to their particular software rather than treat the headline count as a single package.
For individual users, the Paint reports show why a published fix is not always proof that a device has received a corrected version. The source recommends checking Paint separately through the Microsoft Store. It also advises prioritizing Outlook and Office updates, then reviewing Critical server issues relevant to the organization’s network.
Popular right now
Ninja Crispi Microwave & Air Fryer with FusionCrisp Technology, 14-in-1, Black (MW101BK1)
KitchenAid Artisan 5-Qt Tilt Head Stand Mixer, Milkshake
Samsung 48 4K OLED Smart TV (2026) with WireLogic 8ft Ultra High Speed HDMI Cable
As an affiliate, we earn on qualifying purchases.
A Year of Larger Release Counts
The release count has varied sharply in Microsoft’s own figures. The source’s review of Security Update Guide notes lists 63 Microsoft CVEs in November 2025, then 65 in December. It records 220 in June 2026, 663 in July, 999 in September and 1,474 in October, before November’s 1,094. The source calculates that November’s count is about 17 times the year-earlier figure; that comparison uses the November 2025 count as its baseline.
Microsoft has said several factors contribute to growing vulnerability discoveries. Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, wrote in April that AI “can discover more issues, more quickly, across a broader surface area than previous methods.” A May post said advanced AI models are part of the discovery process, while also citing improved automation and broader participation by external researchers. Microsoft has said it expects releases to keep trending larger for some time.
The release notes’ total also has a defined scope. The source analysis says Microsoft’s November data file contains entries from other vendors as well as Microsoft, including Chrome vulnerabilities republished for Edge. After separating those entries and accounting for the earlier Entra Device Registration publication, the source reconciles the Microsoft-specific release-note count with the figures reported by Microsoft and Krebs on Security.
““This release consists of 1094 Microsoft CVEs.””
— Microsoft Security Update Guide, November 2026 release notes
What the Counts Cannot Show
Microsoft has not said how many of November’s fixes were found with AI, or how much its own internal tools contributed. The source analysis identifies 24 November entries whose researcher credit mentions using an AI model—23 naming GLM from z.ai and one naming Claude—but those public credit lines do not reveal Microsoft’s internal discovery methods or establish AI’s share of all fixes.
The source says the number of monthly Microsoft flaws marked exploited remained between zero and six during the period it reviewed, with one in November. That is a count of vulnerabilities flagged in Microsoft’s data, not a complete measure of attacks or exposure. The available material also does not establish how many people or organizations were affected by the Outlook flaw, or how many Paint users have received version 11.2609.401.0.
The reports do not provide a complete account of the Paint rollout or explain why some users could not see the corrected version. The status of the initial Paint fix and the distribution of the revised version therefore remain separate questions for affected users to check.
Check Updates on Affected Devices
Users and administrators should check that Outlook and related Office updates are installed, paying particular attention to systems that can open files from untrusted sources. Organizations should review Microsoft’s release details for server products in use and prioritize applicable Critical fixes according to their exposure and patching procedures.
Paint users should check the Microsoft Store for version 11.2609.401.0 and confirm the installed version rather than assuming the earlier update resolved CVE-2026-83844. Microsoft may provide further clarification on the rollout, but the source material gives no timeline for when the corrected version will be available to every user.
Administrators can also watch Microsoft’s Security Update Guide and CISA’s exploited-vulnerability catalog for changes to vulnerability details or remediation guidance. The immediate next step is verification: install the applicable security updates, then confirm that affected software is running the corrected version.
Key Questions
How many Microsoft CVEs are listed in the November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security reported 1,093 fixes published that day; the source attributes the difference to a cloud flaw published five days earlier.
Which November vulnerability was already being exploited?
CVE-2026-124194, an Outlook spoofing vulnerability rated moderate by Microsoft, was marked “Exploitation Detected.” CISA added it to its catalog of exploited vulnerabilities on November 10.
What is the reported problem with the Paint fix?
Heise reported that the Paint version initially named as fixed for CVE-2026-83844 remained vulnerable. The corrected version is identified as 11.2609.401.0; PC Gamer reported that it was not appearing for some users.
Did Microsoft say AI found all or most of these vulnerabilities?
No. Microsoft has described AI as one part of its discovery process and cited other factors, including improved automation and outside researchers. It has not said how many of November’s fixes came from AI.
Source: ThorstenMeyerAI.com
