🔍 Read the full analysis: Paint Gets A Fix As Microsoft Addresses 1,094 Flaws This Patch Tuesday on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft’s November 10, 2026, release notes list 1,094 Microsoft CVEs, including an Outlook flaw that was exploited before a fix was available. A separate Paint vulnerability has a reported versioning problem, and some users may not yet see the corrected update. Microsoft has not said how many November fixes were found with AI tools.
Microsoft’s November 10, 2026, Patch Tuesday release lists 1,094 Microsoft CVEs, including an Outlook vulnerability Microsoft marks as exploited before a fix was available. The release is the second consecutive month with more than 1,000 listed vulnerabilities, while a separate, previously disclosed Paint flaw remains a concern because the first version Microsoft identified as fixed was reported to remain vulnerable.
Microsoft’s Security Update Guide says the November release consists of 1,094 Microsoft CVEs. Krebs on Security counted 1,093 vulnerabilities published on November 10; the one-item difference is CVE-2026-109469, a Critical flaw in Entra Device Registration that Microsoft published on November 5 and says requires no customer action. The source’s review of Microsoft’s monthly data says the release-note figure excludes vulnerabilities issued by other vendors.
The most urgent item identified in the source is CVE-2026-124194 in Outlook. Microsoft rates it Moderate, with a CVSS score of 6.5, but marks it “Exploitation Detected.” According to Microsoft’s description, an unauthenticated attacker can use a specially crafted file to expose a user’s NTLMv2 password hash. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its catalog of exploited flaws on November 10. The source advises prioritizing Outlook and Office updates, then reviewing relevant Critical server fixes.
A separate issue affects Paint vulnerability CVE-2026-83844, published October 13. Heise reported that the Paint version Microsoft initially identified as fixed remained vulnerable. Microsoft named version 11.2609.401.0 as the working version on November 6, but PC Gamer reported that it was not appearing for some users. The source recommends checking Paint separately through the Microsoft Store; it does not establish that every user is affected or that the version is now available to all.
Microsoft’s November Patch Tuesday 1,094 flaws and two update checks
The release includes an Outlook flaw Microsoft marks as exploited. A separate Paint fix may not yet be available to every user.
Prioritize known exploitation
The Outlook flaw is rated Moderate, but its exploited status makes it a practical priority for IT teams.
Prioritize updates associated with the exploited Outlook vulnerability.
Assess relevant Critical server updates for your environment.
Check that updates installed successfully on each system.
The patch count is rising
Monthly Microsoft release-note counts show a sharp increase from November 2025 to November 2026.
Check Paint separately
The reported fix may not appear for every user, so verify the app on each device.
- Paint version 11.2609.401.0 was identified as the working version.
- Some users reportedly could not see that version.
- Check Paint through the Microsoft Store.
- Compare the installed version with 11.2609.401.0.
AI attribution has limits
Researcher credits do not reveal how many fixes Microsoft found internally with AI tools.
24 entries
The source reports 24 entries crediting researchers who used an AI model.
Microsoft’s internal use
Microsoft has not said how many November fixes were found using AI.
Prioritize the Exploited Outlook Flaw
The size of the release can make it harder for organizations to triage updates, but the raw CVE total does not show which vulnerabilities are being used in attacks. In November, the specific distinction to watch is one flaw marked exploited: the Outlook issue is rated Moderate, yet its reported use in attacks gives it practical urgency beyond its severity label.
Microsoft’s monthly data review in the source found between zero and six exploited flaws per month, despite the much larger overall patch counts. That comparison is limited to the source’s count of entries marked “Exploited: Yes”; it does not measure unreported attacks or predict which vulnerabilities might be exploited later. For IT teams, the release calls for prioritizing based on exposure and known exploitation, rather than treating all 1,094 entries as equally urgent.
The Paint report carries a different operational concern: a fix may be listed without the corrected version being visible to every user. Users and administrators may need to verify the installed version instead of assuming that a general update notice means the issue is resolved on their devices.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Glare-Free Display, Black
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
A Patch Count That Keeps Climbing
Microsoft’s release notes show a sharp rise in the number of listed vulnerabilities over the past year. The source reports 63 Microsoft CVEs in November 2025, followed by 65 in December, 220 in June 2026, 663 in July, 999 in September and 1,474 in October. November’s 1,094 is about 17 times the November 2025 count. That comparison uses the source’s monthly release-note counts and does not mean the number of exploited vulnerabilities rose at the same rate.
Microsoft has attributed larger releases to several factors, including better automation, contributions from outside researchers and AI-assisted discovery. In an April post, Microsoft Security Response Center engineering vice president Tom Gallagher said AI “can discover more issues, more quickly, across a broader surface area than previous methods.” In May, Gallagher wrote that “Advanced AI models are part of the discovery picture and help to accelerate it,” while cautioning that the trend was not driven by one model or one change.
The source found that 24 November entries credited researchers with using an AI model: 23 referred to GLM from z.ai and one to Claude. Those credits do not establish how many issues Microsoft found internally with AI. The release’s product breakdown is led by Windows, with 726 CVEs, followed by Office with 174, SQL Server with 59, Developer Tools with 53 and SharePoint Server with 27.
“AI “can discover more issues, more quickly, across a broader surface area than previous methods.””
— Microsoft Security Response Center engineering vice president Tom Gallagher, in an April post
Paint Availability and AI Attribution
Microsoft has not disclosed how many November fixes were found using AI. Researcher credit lines identify AI use in 24 entries, but they do not reveal Microsoft’s internal tools or the share of vulnerabilities discovered with them. Microsoft has described AI as one part of a broader process rather than assigning it a specific portion of the month’s total.
The source also does not establish whether every Paint user can access version 11.2609.401.0, how many users still have an affected version, or whether Microsoft has since expanded its availability. The reports from Heise and PC Gamer describe different stages of the update and should not be read as proof that the current version remains vulnerable for all users. Microsoft has not provided a user-by-user status in the supplied material.
The Outlook flaw is identified as exploited, but the material does not specify the number of attacks, affected users or organizations, or whether exploitation is continuing. CISA’s listing confirms its inclusion in the agency’s exploited-vulnerability catalog, not the scale of incidents.
Verify Updates on Each Device
Organizations should review Microsoft’s November guidance against their own systems, prioritizing the Outlook and Office updates associated with the exploited flaw and addressing relevant Critical server vulnerabilities based on their environment. Administrators should confirm that updates installed successfully and follow Microsoft’s guidance for any systems that cannot be patched immediately.
For Paint, users can check the app’s version through the Microsoft Store and compare it with 11.2609.401.0, the version identified in the source as the working update. Because reports indicate that the version may not be showing for some users, availability should be verified rather than assumed. Microsoft may provide further clarification through its Security Update Guide or the Store; the supplied material does not give a timetable for broader Paint availability.
Key Questions
How many vulnerabilities did Microsoft list in its November 2026 release?
Microsoft’s November 10 release notes list 1,094 Microsoft CVEs. Krebs on Security counted 1,093 published on that date; the difference is a Critical Entra Device Registration flaw Microsoft published five days earlier.
Which November vulnerability was marked as exploited?
CVE-2026-124194 in Outlook is marked “Exploitation Detected” by Microsoft. Microsoft rates it Moderate, and its description says a crafted file can expose a user’s NTLMv2 password hash.
What is the issue with the Paint update?
The source says Heise reported that the version Microsoft initially named as fixed for CVE-2026-83844 remained vulnerable. Microsoft named version 11.2609.401.0 on November 6, but PC Gamer reported that some users could not yet see it.
Did AI account for most of the November fixes?
That is not established. The source found 24 November entries with researcher credits mentioning AI use, but those credits do not reveal Microsoft’s internal discovery methods or the total share attributable to AI.
What should users and IT teams check first?
The source advises prioritizing Outlook and Office updates, then addressing relevant Critical server flaws. Paint should be checked separately through the Microsoft Store, since the reported corrected version may not appear for every user.
Source: ThorstenMeyerAI.com
