Microsoft fixes 1,093 flaws, including an exploited Outlook zero-day credited to a ...

Microsoft patched 1,093 vulnerabilities it assigned on Nov. 10, 63 rated critical; the full release lists 1,342 entries once Chromium and open-source component fixes are included [1] [4] .

The one exploited bug, Outlook flaw CVE-2026-124194, leaks a user's NTLMv2 hash when a crafted message file is opened; CISA ordered federal agencies to patch by Nov. 24 [2] [3] .

Microsoft credited the discovery to Benoît Sevens "using Claude with Anthropic" and a researcher called "nono" [2] .

Microsoft released fixes for 1,093 vulnerabilities on Nov. 10, including an Outlook flaw, CVE-2026-124194, that it says attackers are already exploiting [1] [2] . It is the second straight month above 1,000, after 900 in September and more than 1,400 in October, The Record reported [4] . SecurityWeek put October's total at a record 1,413, so November is high but not a record [5] .

Microsoft credited the Outlook bug's discovery to Benoît Sevens "using Claude with Anthropic" and to a researcher using the handle "nono" [2] . An attacker sends a crafted message file; if the victim opens it, Outlook connects to an attacker-controlled network location without its usual external-content warning and discloses the user's NTLMv2 hash, which the attacker "could use ... to authenticate as the user," Microsoft said [2] . The Preview Pane is not an attack vector. Microsoft rates the flaw Moderate, with a CVSS score of 6.5, and it affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 [2] [5] . Microsoft gave no details of the attacks [5] . CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until Nov. 24 to fix it [3] .

Why the counts differ

Microsoft's machine-readable data for the November release lists 1,342 CVE entries, by an MLQ.ai count [1] . Microsoft itself assigned 1,095 of them, and 1,093 of those were first published on Patch Tuesday, the figure The Record used; 63 are rated Critical [1] [4] . SecurityWeek's 1,094 adds one non-Microsoft CVE published the same day, and it noted that Microsoft also republished 165 third-party CVEs, which are the Chromium bugs fixed in Edge [1] [5] . BleepingComputer's 1,235 counts the Edge Chromium fixes and open-source component flaws in Microsoft's Mariner Linux distribution, while leaving out 108 flaws fixed earlier in the month [6] .

The AI credit on an exploited Microsoft bug comes days after Linus Torvalds said AI-generated fixes drove much of Linux 7.4-rc2 . Microsoft has not said why its monthly totals have climbed. Other vendors also shipped fixes on Tuesday: SAP patched four maximum-severity flaws , Google fixed Chrome's eighth exploited zero-day of 2026 , and CISA gave agencies until Friday to patch two exploited Barracuda email security bugs [4] .