Microsoft fixes 1,093 flaws, including an exploited Outlook zero-day credited to a researcher using Anthropic's Claude - MLQ.ai
Microsoft released fixes for 1,093 vulnerabilities on November 10, including an Outlook flaw that attackers are already exploiting, discovered with help from Anthropic's Claude AI.
Microsoft released fixes for 1,093 vulnerabilities on November 10, including an Outlook flaw that attackers are already exploiting. It is the second straight month above 1,000, after about 900 in September and more than 1,400 in October. The full release lists 1,342 entries once Chromium and open-source component fixes are included.
Exploited Outlook Bug
The one exploited bug, Outlook flaw CVE-2026-124194, leaks a user's NTLMv2 hash when a crafted message file is opened. Microsoft credited the discovery to Benoît Sevens "using Claude with Anthropic" and a researcher called "nono".
An attacker sends a crafted message file; if the victim opens it, Outlook connects to an attacker-controlled network location without its usual external-content warning and discloses the user's NTLMv2 hash, which the attacker "could use ... to authenticate as the user."
Microsoft rates the flaw Moderate, with a CVSS score of 6.5, and it affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The Preview Pane is not an attack vector. Microsoft gave no details of the attacks.
Patch Count Discrepancies
Microsoft's machine-readable data for the November release lists 1,342 CVE entries, by an MLQ.ai count. Microsoft itself assigned 1,095 of them, and 1,093 of those were first published on Patch Tuesday. SecurityWeek's 1,094 adds one non-Microsoft CVE published the same day, and it noted that Microsoft also republished 165 third-party CVEs, which are the Chromium bugs fixed in Edge.
By SecurityWeek's tally, Windows accounted for 726 of the fixes, Office 174, SQL Server 59, developer tools 53, SharePoint Server 27, Azure 20 and Exchange Server 9. Critical fixes went to Windows 10 and 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, the Malware Protection Engine, Azure OpenAI and Azure Managed Grafana.
Industry Context
Microsoft has disclosed more than 5,160 vulnerabilities so far this year. The AI credit on an exploited Microsoft bug comes days after Linus Torvalds said AI-generated fixes drove much of Linux 7.4-rc2. Microsoft has not said why its monthly totals have climbed.
Other vendors also shipped fixes on Tuesday: SAP patched four maximum-severity flaws, Google fixed Chrome's eighth exploited zero-day of 2026, and CISA gave agencies until Friday to patch two exploited Barracuda email security bugs. CISA added the Outlook bug to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until November 24 to fix it.
Related
