🔍 Read the full analysis: Why One Microsoft Flaw Is Under Attack Amid 1,094 Patch Tuesday Fixes on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft’s November 10, 2026, security release lists 1,094 Microsoft CVEs, and the company says one Outlook spoofing flaw, CVE-2026-124194, was exploited before a fix was available. CISA added that vulnerability to its catalog of exploited flaws on November 10. Microsoft has linked larger releases to AI-assisted discovery and other factors, but has not disclosed how much AI contributed to this month’s fixes.
Microsoft’s November 10, 2026, security update lists 1,094 Microsoft CVEs, including an Outlook vulnerability that the company says attackers exploited before a fix was available. The exploited flaw, CVE-2026-124194, is rated Moderate, but its reported use in attacks and potential to expose password hashes make it a priority for Outlook and Office users.
Microsoft identifies CVE-2026-124194 as an Outlook spoofing vulnerability and marks it “Exploitation Detected” in the November release. The supplied reporting says an attacker could exploit it by sending a crafted file, potentially causing a user’s NTLMv2 password hash to be disclosed. Microsoft assigned it a CVSS score of 6.5 and a Moderate severity rating. CISA added the vulnerability to its catalog of exploited flaws on November 10.
The release notes list 1,094 Microsoft CVEs, while Krebs on Security counted 1,093 published on November 10. The difference is one Entra Device Registration issue, CVE-2026-109469, which Microsoft published on November 5 and says requires no customer action. According to the source’s examination of Microsoft’s data, the release also contains entries for other vendors’ vulnerabilities, but those are excluded from Microsoft’s 1,094-CVE headline count.
The release is large, though not the biggest in the recent sequence described by the source: October 2026 listed 1,474 CVEs. Microsoft has said AI-assisted discovery is among the factors behind larger releases, alongside improvements to automation and contributions from outside researchers. The company has not said how many November fixes came from AI, and researcher credit lines alone do not establish the extent of Microsoft’s internal use of AI tools.
Why One Microsoft Flaw Is Under Attack Amid 1,094 Patch Tuesday Fixes
Microsoft’s November release lists 1,094 CVEs. One Outlook flaw was exploited before a fix was available, making it a priority for security teams.
Why the Outlook flaw matters
CVE-2026-124194 is rated Moderate, but Microsoft reports exploitation before a fix was available.
The reported attack begins with a file sent to an Outlook user.
Successful exploitation could disclose an NTLMv2 password hash.
Microsoft marked the flaw “Exploitation Detected”; CISA added it to its exploited flaws catalog.
Patch volume in context
Monthly totals have grown, but the release count is not the number of flaws known to be under attack.
AI explains only part of the picture
Microsoft cites AI-assisted discovery, automation and outside researchers as factors in larger releases.
- 24 entries credit researchers with using an AI model.
- 23 cite GLM from z.ai; one cites Claude.
- Microsoft says advanced AI models are part of the discovery picture.
- Microsoft has not disclosed AI’s contribution to the November fixes.
- Researcher credits do not account for internal AI use.
- The number of affected people, organizations and confirmed attacks is not provided.
Prioritize and verify
Use exploitation status and your own environment to guide deployment.
- Patch Outlook and Office for CVE-2026-124194, then confirm installation.
- Review relevant Critical server fixes based on exposure and operational needs.
- Check Microsoft Store updates for Paint and verify the installed version.
Why the Outlook flaw merits priority
The key security concern is not the release’s total count but the evidence of exploitation tied to a specific Outlook flaw. A vulnerability that could expose an NTLMv2 password hash may create risk beyond a single email client, since hashes can be useful to attackers in attempts to access accounts or systems. The supplied material does not establish how many people or organizations were affected, so the scale of real-world exposure remains unknown.
The flaw’s Moderate rating also shows why administrators should not use severity labels alone to set patch order. Known exploitation is a separate signal: a lower-rated flaw already being used in attacks may deserve faster attention than a Critical issue with no reported exploitation, depending on a network’s products and exposure. The source recommends patching Outlook and Office first, then reviewing relevant Critical server fixes and checking the separate Paint issue.
The four-digit release count matters for security teams because it increases the volume of fixes that may need review, testing and deployment. But the count does not mean attackers have found or are exploiting a comparable number of flaws. The source’s review of Microsoft’s monthly data says the number marked “Exploited: Yes” stayed between zero and six per month in the period examined, with one in November. That is a count of flagged vulnerabilities, not a measure of attacks or victims.
Products Worth Considering
Samsung Galaxy Tab A11+ 8GB RAM, 256GB Storage, Gray
Sonos Arc Ultra Soundbar with Dolby Atmos, Black
Bose TV Speaker (2nd Gen) Compact Soundbar
As an affiliate, we earn on qualifying purchases.
A year of expanding patch lists
The November total is far above the 63 Microsoft CVEs listed for November 2025 in the source’s comparison of Microsoft’s Security Update Guide. The same account records 65 in December 2025, 220 in June 2026, 663 in July, 999 in September and 1,474 in October. Those figures describe listed vulnerabilities across monthly releases; they should not be confused with the number of flaws known to be under active attack.
Microsoft has offered a broad explanation for the increase. In April, Tom Gallagher, a vice president of engineering at the Microsoft Security Response Center, wrote that AI “can discover more issues, more quickly, across a broader surface area than previous methods.” In a May post, Gallagher said advanced AI models were “part of the discovery picture” and that Microsoft expected releases “to continue trending larger for some time.” He also pointed to more mature automation and wider participation by outside researchers, rather than attributing the trend to a single model or change.
In the November data, 24 entries reportedly credit researchers with using an AI model: 23 cite GLM from z.ai and one cites Claude. The credit for the Outlook flaw names Benoît Sevens “using Claude with Anthropic,” alongside a second researcher identified as “nono.” These acknowledgments concern credited research; they do not disclose whether Microsoft used AI internally to find or validate each vulnerability.
“This release consists of 1094 Microsoft CVEs.”
— Microsoft Security Update Guide, November 2026 release notes
What the release does not establish
The supplied reporting does not give a count of affected users, organizations or confirmed attacks involving CVE-2026-124194. It also does not detail the observed attack activity or establish whether the potential exposure of an NTLMv2 hash occurred in every successful exploitation. Microsoft and CISA’s inclusion of the flaw as exploited confirms the reported status, but not the scale or consequences of those incidents.
Microsoft has not provided a breakdown of AI’s contribution to the 1,094 fixes. The 24 researcher credit lines that mention AI models are not a complete accounting of internal discovery methods. Separately, the source reports that a Paint vulnerability, CVE-2026-83844, was published October 13; heise said the version Microsoft first named as fixed remained vulnerable. Microsoft named version 11.2609.401.0 on November 6, while PC Gamer reported that some users still could not see it. The current status for all affected Paint installations is not established by the supplied information.
Patch Outlook and verify Paint
Organizations should apply the Outlook and Office updates addressing CVE-2026-124194 and confirm that installation succeeded. Administrators can then prioritize the Critical server vulnerabilities that affect products in their own environments, taking account of exposure and operational needs. The source does not provide enough detail to rank every server fix for every organization.
For Paint, users and administrators should check Microsoft Store updates separately and verify the installed version rather than assuming the initial fixed-version notice reached every device. Microsoft has not supplied, in the material provided, a further timetable for Paint availability or a detailed public account of the Outlook exploitation. Those details, along with any later revisions to Microsoft’s advisory, remain the next developments to watch.
Key Questions
Which flaw was reported as exploited?
CVE-2026-124194, an Outlook spoofing vulnerability, is marked “Exploitation Detected” in Microsoft’s November release. CISA added it to its catalog of exploited flaws on November 10, 2026.
Why does a Moderate-rated flaw receive priority?
The supplied reporting says the Outlook flaw was exploited before its fix and could expose an NTLMv2 password hash. Evidence of exploitation can affect patch priority even when a flaw’s severity rating is not Critical.
What does the 1,094 figure count?
It is the number of Microsoft CVEs in Microsoft’s November 10, 2026, release notes. Krebs on Security counted 1,093 published that day; the one-count difference is an Entra Device Registration flaw Microsoft published five days earlier.
Did AI produce all or most of the fixes?
That has not been established. Microsoft says AI is part of its vulnerability-discovery process, alongside automation and outside research, but has not disclosed how many of November’s fixes came from AI.
What should users do about the Paint vulnerability?
The source recommends checking Paint separately through the Microsoft Store and verifying the installed version. It reports that version 11.2609.401.0 was named as the working fix on November 6, but some users reportedly could not see it.
Source: ThorstenMeyerAI.com
