By Thorsten Meyer | November 11, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- The number: Microsoft’s November 2026 release notes list 1,094 Microsoft CVEs. A year ago, in November 2025, the same page listed 63. Krebs on Security, which reported the release as “almost 1,100” fixes, counts 1,093; the difference is one cloud flaw Microsoft published five days earlier.
- Under attack: One flaw, CVE-2026-124194 in Outlook, was exploited before the fix. Opening a crafted file can leak a user’s NTLMv2 password hash. CISA added it to its list of exploited flaws on November 10.
- Why so many: Microsoft says AI is part of the answer. Its security team wrote in May that “Advanced AI models are part of the discovery picture” and that it expects releases “to continue trending larger for some time”. It has not said how many of November’s fixes came from AI.
- The Paint mess: A separate Paint flaw, CVE-2026-83844, was published on October 13. The version Microsoft first named as fixed was still vulnerable, according to heise. The working version, 11.2609.401.0, was named on November 6, and PC Gamer reports it still is not showing up for some users.
- What to do: Patch Outlook and Office first, then the handful of Critical server flaws that matter in your network, and check Paint separately through the Microsoft Store.
Products Worth Considering
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Jackery Explorer 300 Portable Power Station with 40W Solar Panel, 292Wh
As an affiliate, we earn on qualifying purchases.
A four-digit Patch Tuesday, again
Patch Tuesday used to be a manageable ritual. On the second Tuesday of the month, Microsoft shipped a few dozen fixes, admins tested them, and the rest of us clicked restart.
That rhythm is gone. Microsoft’s release notes for November 10, 2026, say: “This release consists of 1094 Microsoft CVEs”. Krebs on Security called it “another four-digit patch drop”. The last one was in October, with 1,474.
I wanted to see the trend in Microsoft’s own data, so I went back through the Security Update Guide release notes month by month. November 2025: 63 Microsoft CVEs. December 2025: 65. Then the curve bends: 220 in June 2026, 663 in July, 999 in September, 1,474 in October. November’s 1,094 is about 17 times the count of a year earlier. Added up, January to November 2026 come to 5,523. Krebs puts the year at “more than 5,100 security patches so far”, which matches the direction, if not the exact method.
The right-hand column in that chart is the part that surprised me most. In each month’s Microsoft data file, I counted the Microsoft CVEs flagged “Exploited:Yes”. The total number of fixes grew 17-fold. The number of flaws already used by attackers did not: it stayed between zero and six per month, and it is one in November.
How I counted: Microsoft publishes each month’s security data as a machine-readable file through its Security Update Guide API. The November file holds 1,342 entries. 247 of them come from other vendors, mostly Chrome, whose flaws also reach Microsoft Edge; Microsoft republishes those. 1,095 name Microsoft as the issuing authority. Minus one Edge entry, that gives the 1,094 in the release notes. 1,093 of them were first published on November 10, which is the number Krebs reports. The extra one is CVE-2026-109469, a Critical flaw in Entra Device Registration, published on November 5, for which Microsoft says no customer action is needed. So the big number is not padded with other vendors’ bugs. These are Microsoft’s own.
Why the number is so high
Microsoft has explained this, in its own words, more than once this year.
In April, Tom Gallagher, VP Engineering at the Microsoft Security Response Center (MSRC), wrote that AI “can discover more issues, more quickly, across a broader surface area than previous methods” and that “we will discover a greater volume and diversity of vulnerabilities”. In the same post, Microsoft said it had early access to Anthropic’s Claude Mythos Preview.
In May, in a post titled “A note on Patch Tuesday”, Gallagher went further: “Advanced AI models are part of the discovery picture and help to accelerate it.” He also wrote that “This is not driven by any one model or any one change”, and listed other causes: more mature automation tooling and broader participation by outside researchers. Microsoft said it expects “releases to continue trending larger for some time” and that it is “not changing our bug bar”. Krebs sums it up the same way: “Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months.”
What the November data shows on its own is thinner. Each CVE carries a credit line. In 24 of the 1,093 entries published on November 10, the credit says the researcher worked “using” an AI model: 23 times “GLM from z.ai”, once Claude. The credit for the exploited Outlook flaw reads “Benoît Sevens using Claude with Anthropic”, alongside a second researcher listed as “nono”. Credit lines do not show the tools Microsoft uses internally, so they say little about the real AI share.
Here is the November release, broken down by Microsoft’s own ratings:
By product family, the release notes split the 1,094 like this:
| Product family | Microsoft CVEs |
|---|---|
| Windows | 726 |
| Office | 174 |
| SQL Server | 59 |
| Developer Tools | 53 |
| SharePoint Server | 27 |
| Other | 25 |
| Azure | 20 |
| Exchange Server | 9 |
| Defender | 1 |
The one that is already being used: Outlook
The fix that matters most this month is not one of the Critical ones. Microsoft rates CVE-2026-124194, a “Microsoft Outlook Spoofing Vulnerability”, only “Moderate”, with a CVSS score of 6.5. But it is the only flaw in the release marked “Exploitation Detected”.
Microsoft describes the attack like this: “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.” Opening it could make Outlook “connect to an attacker-controlled network location without displaying the usual external-content warning”. The result, in Microsoft’s words: the flaw “discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.”
In plain words: one wrong double-click can hand an attacker a scrambled form of your Windows login, which can be used to log in as you elsewhere in the network. Two details limit the damage. The user has to open the file, and Microsoft says the Preview Pane “is not an attack vector”.
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected. The fixed builds it names are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 10, with a deadline of November 24 for US federal agencies. CISA lists ransomware use as “Unknown”.
What businesses should patch first
Microsoft itself does not want anyone to treat 1,094 fixes as 1,094 emergencies. Its May advice to customers: “Triage by exposure and impact, not raw count.” In October, it also published an exploratory idea it calls “risk cohorts”: grouping CVEs by the question they raise about your environment, for example whether you run RD Gateway or which Office apps open outside files. Microsoft stresses that these groupings “are not official Microsoft vulnerability categories”.
Using only Microsoft’s own ratings, here is a sensible order:
- Outlook and Office, now. CVE-2026-124194 is the one attackers already use. Check that Microsoft 365 Apps and Office LTSC actually reached the fixed builds.
- Five Critical flaws Microsoft rates “Exploitation More Likely”. Two in Active Directory Domain Services (CVE-2026-118146 and CVE-2026-118148), one in Exchange Server (CVE-2026-118207), one in Schannel (CVE-2026-119952) and one in Windows NAT (CVE-2026-113862). Domain controllers and Exchange servers are where a break-in hurts most.
- Critical network flaws that need no login and no click. By the CVSS vectors in Microsoft’s data, 14 Critical flaws can be attacked over the network without privileges or user action. Five of them are in Message Queuing. Others include LDAP (CVE-2026-119958, CVSS 9.8) and Windows Search (CVE-2026-116928, CVSS 9.8). If a server does not run the affected role, that flaw drops down your list.
- Paint, separately. The Paint fix comes through the Microsoft Store, not with the monthly Windows update. More on that below.
- Everything else on your normal cycle. 42 flaws carry Microsoft’s “Exploitation More Likely” rating in total, most of them ways to gain higher rights on a machine an attacker already reached. They belong in the regular rollout, tested and confirmed.
Ivanti’s Chris Goettl made the same point in the Krebs report: “Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.”
The messy Paint fix
Then there is Paint, the drawing program that ships with Windows. Its flaw, CVE-2026-83844, is not part of the November count. Microsoft published it on October 13, in the October release. What happened after that is a lesson in how not to roll out a fix.
Microsoft describes the flaw as an “Out-of-bounds read in Windows Paint” that “allows an unauthorized attacker to execute code locally”. An attacker would have to get someone to open a crafted file. According to heise, the entry first named Paint 11.2605.91.0 as fixed, but “that version remained vulnerable”. On Friday, November 6, Microsoft updated the entry: “Microsoft has released a new version of Paint with build version number 11.2609.401.0.” Microsoft’s Paint release notes for that version are dated the same day and list, among other changes: “Opening a damaged or unsupported file now shows an error message instead of closing unexpectedly.”
On Saturday, November 7, Microsoft “Added an FAQ and updated the CVSS score”. heise reports that the score was first 8.1 and is now 7.0, because the attack vector is local, not network. The entry now explains that the word “Remote” in the title “refers to the location of the attacker”.
The rollout is the real problem. Paint updates through the Microsoft Store, not through Windows Update. According to PC Gamer, “Some users don’t have automatic Microsoft Store updates enabled, especially those on work machines.” PC Gamer reports that the update “still isn’t showing up for some” and calls the situation “the biggest omnishambles of conflicting cybersecurity info I’ve seen in a while”. heise says that anyone with automatic Store updates turned on “is already protected”. PC Gamer points to reports that even with automatic updates on, the new version did not arrive for everyone. Those two statements do not fit together, so check by hand.
How to check Paint: open Paint, click the gear icon in the top right, and read the version number. If it is lower than 11.2609.401.0, open Paint’s page in the Microsoft Store and update. Admins can query it with PowerShell, as PC Gamer shows:
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, VersionDo not mix it up with CVE-2026-70586, a different Paint flaw from September. Microsoft fixed that one through the regular Windows security updates.
What home users should do
You do not need to read 1,094 advisories. Three steps cover almost everything:
- Windows Update, then restart. Install the November update and restart when Windows asks.
- Update Office or Microsoft 365. Use Office’s own update option. This covers the Outlook flaw.
- Microsoft Store, then Paint. Let the Store update your apps, then check the Paint version as described above.
The same week, Google patched an exploited flaw in Chrome, which I covered in Chrome’s eighth zero-day of 2026. If you use Chrome or Edge, update the browser too.
What is not known
- How many November fixes came from AI. Microsoft says AI is “part of the discovery picture”, but it gives no share for November. Credit lines name an AI model in 24 entries; Microsoft’s internal tools are not visible there.
- Who used the Outlook flaw, and against whom. Microsoft marks it “Exploitation Detected” but publishes no details. CISA lists ransomware use as “Unknown”.
- Why the Paint update did not reach some machines. Microsoft has not explained the first, wrong version number in the sources I checked. Microsoft rates the Paint flaw “Exploitation Less Likely” and does not list it as exploited.
- Whether the volume keeps growing. Microsoft expects larger releases “for some time”. Whether teams can keep up is the open question; MSRC itself says that “customers should be prepared for more frequent cases where out-of-band updates require immediate attention.”
The bottom line
A four-digit Patch Tuesday sounds like a security crisis. Microsoft’s own data says something more nuanced: the number of known holes is exploding, while the number attackers are already using is not. That shifts the job. The hard part is no longer installing patches, it is deciding which ones cannot wait. This month, that is Outlook, a short list of server flaws, and, thanks to a clumsy rollout, a drawing program that most people forgot was even there.
For more context, read what the data shows about AI, bug hunters and the patch gap and why the patch window just shrank.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- Microsoft Security Update Guide: “November 2026 Security Updates” release notes, msrc.microsoft.com, checked November 11, 2026; release notes for November 2025 to October 2026, checked November 11, 2026
- Microsoft Security Update Guide API (api.msrc.microsoft.com, CVRF format): monthly security data files for November 2025 to November 2026, downloaded November 11, 2026; counts by Thorsten Meyer AI
- Microsoft: CVE-2026-124194, “Microsoft Outlook Spoofing Vulnerability”, and CVE-2026-83844, “Windows Paint Remote Code Execution Vulnerability”, Security Update Guide entries with revision history
- Microsoft Learn: Paint release notes (Windows Insider), entry dated November 6, 2026
- MSRC blog, Tom Gallagher: “Strengthening secure software at global scale: How MSRC is evolving with AI”, April 7, 2026
- MSRC blog, Tom Gallagher: “A note on Patch Tuesday”, May 12, 2026
- MSRC blog: “Using risk cohorts to prioritize security updates”, October 13, 2026
- CISA: Known Exploited Vulnerabilities catalog, version 2026.11.10, cisa.gov
- Krebs on Security: “Microsoft Fixes Nearly 1,100 Security Vulnerabilities”, November 10, 2026
- heise online, Dirk Knop: “Microsoft Paint: Codeschmuggel-Lücke im Malprogramm” (English edition: “Microsoft Paint flaw lets attackers smuggle code into drawing app”), November 10, 2026
- PC Gamer, Andy Edser: “MS has messily patched a Microsoft Paint security vulnerability, but the update still isn’t showing up for some”, November 10, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No company or agency named here reviewed or sponsored this article. This article is for information only. It is not legal or security-consulting advice. Counts from Microsoft’s data as published on November 10 and 11, 2026; Microsoft may revise its entries. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.
