TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability that was exploited before its fix. The unusually high count follows another four-digit release in October, but Microsoft has not said how many November findings came from AI-assisted work.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 fixes published on November 10; the one-count difference is CVE-2026-109469, a Critical Entra Device Registration flaw published five days earlier. Microsoft says no customer action is needed for that issue. The guide’s monthly data file contains entries from other vendors as well, but the source article’s count excludes those and one Edge entry.
The exploited vulnerability is CVE-2026-124194 in Outlook. The supplied reporting says opening a crafted file can expose a user’s NTLMv2 password hash. The Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on November 10. Microsoft’s credit line names researcher Benoît Sevens, who used Claude with Anthropic, and a second researcher identified as “nono.”
Microsoft’s release notes assign 726 CVEs to Windows, 174 to Office, 59 to SQL Server and 53 to Developer Tools. The remaining entries cover SharePoint Server, Azure, Exchange Server, Defender and other products. These figures describe CVEs in the release, not a count of distinct attacks or confirmed compromises.
Outlook Fix Leads the Priority List
The Outlook issue stands apart from the large batch because it was already exploited before the update. Exposure of an NTLMv2 password hash can create risk for affected users and organizations, so security teams have reason to prioritize the relevant Outlook and Office updates while following Microsoft’s deployment guidance.
The overall volume also affects how administrators plan testing and rollout. Microsoft’s figures include hundreds of Windows and Office issues, alongside vulnerabilities in server and developer products. Organizations will need to map the updates to the software they run and weigh the known exploitation against operational testing needs. The release total alone does not establish that every listed flaw is equally severe or relevant to every network.
The supplied reporting says the number of Microsoft fixes rose from 63 in November 2025 to 1,094 in November 2026. That comparison is based on the monthly release-note counts; it does not mean the number of attacks rose by the same amount. The same source’s review of monthly data found between zero and six Microsoft CVEs marked as exploited per month, with one in November.
Products Worth Considering
Dyson V8 Cyclone Cordless Vacuum
Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux
eufy Security SoloCam E42 4-Camera Kit, 4K Solar Security System
As an affiliate, we earn on qualifying purchases.
A Year of Expanding Releases
Microsoft’s release notes listed 63 CVEs in November 2025, then 220 in June 2026, 663 in July and 999 in September. October’s release reached 1,474, before November’s 1,094. The source article calculates that November’s count is about 17 times the year-earlier figure. Its January-through-November total for 2026 is 5,523, based on its method of counting Microsoft CVEs.
Microsoft has linked the larger releases to several factors. In an April post, MSRC vice president Tom Gallagher said AI can help discover more issues across a broader surface area and that Microsoft expected a greater volume and diversity of vulnerabilities. In May, Gallagher wrote that advanced AI models were part of the discovery picture, alongside more mature automation and broader participation by external researchers. Microsoft said it expected releases to continue trending larger for some time and that it was not changing its bug bar.
The November data provides limited evidence about AI’s specific contribution. According to the source article, 24 CVE credit lines among the 1,093 entries published November 10 mention a researcher using an AI model: 23 cite GLM from z.ai and one cites Claude. Those credit lines do not reveal Microsoft’s internal tools or establish what share of the findings involved AI.
““This release consists of 1094 Microsoft CVEs.””
— Microsoft Security Update Guide
Microsoft has not said how many of November’s vulnerabilities were found through AI-assisted work, either by its own teams or outside researchers. The credit lines reported for some entries identify researchers’ use of models, but do not provide a complete accounting of the discovery process.
The supplied reporting also describes a separate Paint vulnerability, CVE-2026-83844, published October 13. It says the version Microsoft initially identified as fixed remained vulnerable, while version 11.2609.401.0 was named on November 6. PC Gamer reportedly found that the working version was still unavailable to some users. The precise number of affected installations and the current rollout status are not established in the source material.
The available information does not say how many organizations were affected by the Outlook exploitation, how many users’ hashes were exposed, or whether attackers successfully used any captured hashes. The release count also does not indicate how many systems remain unpatched.
Prioritize Outlook and Check Paint
Administrators should review Microsoft’s November guidance, identify affected products in their environments and apply the relevant updates according to their deployment procedures. The supplied source recommends prioritizing Outlook and Office, then assessing the Critical server flaws that apply to each organization’s systems.
Paint should be checked separately through the Microsoft Store, since the reported fix version may not yet be visible to all users. Microsoft’s release guidance and subsequent availability information will clarify the status of that update. Further details on the Outlook exploitation, affected deployments and Microsoft’s use of AI in vulnerability discovery remain to be seen.
Key Questions
How many Microsoft CVEs are in the November 2026 release?
Microsoft’s release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on November 10; the difference is an Entra Device Registration flaw published November 5 for which Microsoft says no customer action is needed.
Which flaw was exploited before the fix?
CVE-2026-124194, an Outlook vulnerability. The supplied reporting says opening a crafted file can expose a user’s NTLMv2 password hash. CISA added it to its exploited-vulnerabilities list on November 10.
Did AI find most of the November vulnerabilities?
That is not established. Microsoft says advanced AI models contribute to vulnerability discovery, but it has not disclosed how many November findings came from AI. The source article found AI references in 24 researcher credit lines among the 1,093 entries published November 10.
What should administrators prioritize?
Review Microsoft’s guidance and prioritize the Outlook and Office updates relevant to your systems, given the reported exploitation of the Outlook flaw. Then assess applicable Critical server updates and check Paint separately through the Microsoft Store.
Source: Thorsten Meyer AI
