From the CrowdStrike edition of November 10, 2026
Krebs on Security: Microsoft fixes 1,093 flaws, crediting AI for record volume, while only 217 of about 95,000 CVEs this year are on CISA's exploited list
Krebs on Security · Independent security journalism (cross-sector) · United States and global
- Publisher
- Krebs on Security
- Original publication
- November 10, 2026
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-10
What happened
Krebs reports Microsoft fixed 1,093 vulnerabilities this month, 63 of them critical, with one exploited Outlook zero-day, and more than 5,100 patches so far this year versus about 100 a month a year ago. Microsoft credits AI for finding the volume. Ivanti's Chris Goettl is quoted that about 95,000 CVEs have been assigned this year across vendors but only 217 added to CISA's Known Exploited Vulnerabilities list, and that 44 percent of exploited flaws sit in edge devices and IT management or remote access tools, which need exposure management alongside patching.
Why it matters
The KEV figures give public IT teams an independent way to narrow the work: most volume is not exploited, and edge devices and remote access tools deserve priority. That is a counterweight to vendor urgency.
Evidence and measured results
Opened the full article (Nov 10). Counts are attributed to Microsoft; the KEV and 44 percent figures are attributed to an Ivanti executive, a patch-management vendor, and were not independently checked here.
Limitations and uncertainty
Journalistic summary; key prioritization statistics come from a patch-management vendor; total count differs from CrowdStrike's 1,252.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public IT teams cannot patch everything and need a defensible way to choose.
- Stakeholders
- CISO
- IT director
- Network and remote access owners
- Auditors
- Discovery questions
- Do you track CISA KEV today?
- Which edge and remote access tools are internet-facing?
- Is endpoint and browser patching automated?
- Value hypothesis
- KEV-driven prioritization may reduce exposure on the systems attackers actually target; no SLED outcome data is reported.
- Potential engagement
- A KEV and edge-device exposure assessment for one agency.
- Unsupported claims
- That the 44 percent figure applies to any one agency
- That AI-found bugs are less or more dangerous
- That patch volume alone measures risk
Pre-sales engineering
Role takeaway
- Fit
- Any SLED organization with mixed endpoints and internet-facing edge devices.
- Architecture and integration
- Tie KEV feed to asset inventory and patch tooling; monitor edge devices separately.
- Prerequisites
- Asset inventory including edge devices
- Automated endpoint patching
- KEV subscription
- Constraints
- Vendor-dependent appliance fixes
- Limited staff
- Legacy remote access tools
- Security
- Prioritize exploited flaws on privileged internet-facing systems.
- Proof of value
- Share of KEV items mitigated within the CISA due date
- Edge device inventory completeness
- Automated patch coverage on endpoints
Delivery
Role takeaway
- Work
- Stand up a KEV-driven priority track and continuous endpoint patching.
- Dependencies
- Inventory
- Patch automation
- Leadership reporting
- Ownership
- CISO with infrastructure and network teams.
- Skills and adoption
- Staff trained to triage by exploitation status.
- Governance checkpoints
- KEV policy adopted
- Monthly coverage report
- Exceptions reviewed
- Acceptance criteria
- Proposed: KEV items mitigated by CISA due dates
- Proposed: edge device inventory reviewed monthly
- Risks
- Ignoring non-KEV flaws later exploited
- Incomplete edge inventory
- Vendor appliance delays
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Edge devices and remote access tools should be inventoried and monitored as a distinct exposure class.
Governance
Who approves, reviews and stays accountable for outcomes?
Using CISA KEV as a priority signal, which CISA directs for federal agencies, offers SLED a defensible prioritization rule.
Security and privacy
What data, permissions and controls need testing?
Exploited flaws concentrate on internet-facing privileged systems, where compromise exposes the broadest data.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Narrowing urgent work to exploited items helps small teams keep pace.
Procurement
What should contracts, pricing and exit terms secure?
Supports exposure-management and patch-automation investments, but cites a vendor executive for its key statistic.
Operating model
Which teams own the service once it runs?
Continuous patching for operating systems and browsers; targeted exposure response for edge and management tools.
Publication history
- 2026-11-10CrowdStrike · Issue 134 resources
Stable resource ID: krebs-microsoft-november-2026-patch-volume-ai-2026-11-10