Microsoft released its May 2026 Patch Tuesday security updates on May 12, 2026, at 10:00 AM PST, marking a significant milestone as the first release in nearly two years without any actively exploited or publicly disclosed zero-day vulnerabilities. This release addresses 120 CVEs across Windows, Office, Azure, and server products, including 16 critical-severity vulnerabilities (13.56%) and 102 important-severity vulnerabilities (86.44%). The absence of zero-days provides a strategic window for IT teams to accelerate patch deployment, though the volume of fixes and approaching June 26, 2026 Secure Boot certificate expiration deadline demand immediate attention.
Severity Distribution
| Severity Level | Count | Percentage |
|---|---|---|
| Critical | 16 | 13.56% |
| Important | 102 | 86.44% |
The severity distribution shows a relatively low proportion of critical vulnerabilities compared to the important-severity issues, with critical vulnerabilities representing just over 13% of the total. This distribution suggests that while the volume of fixes is substantial, the majority are important-severity issues that require timely patching but may not pose immediate exploitation risk.
Vulnerability Types Breakdown
The release includes 31 remote code execution vulnerabilities, 61 elevation of privilege flaws, 15 information disclosure bugs, 15 spoofing vulnerabilities, 8 denial of service flaws, and 6 security feature bypass issues. Elevation of privilege vulnerabilities represent the largest category at 44.85%, followed by remote code execution issues at 22.79%. This distribution highlights the need for organizations to prioritize patches affecting domain controllers, DNS clients, Microsoft Office applications, SharePoint servers, and Azure services to minimize enterprise risk.
Despite the positive news of no zero-days, organizations must prioritize critical patches affecting domain controllers, DNS clients, Microsoft Office applications, SharePoint servers, and Azure services to minimize enterprise risk.
Historical Context: Breaking the Zero-Day Streak
The May 2026 Patch Tuesday represents a watershed moment in Microsoft’s security update cadence, breaking a remarkable 22-month streak of consecutive releases containing at least one zero-day vulnerability either exploited in the wild or publicly disclosed . Every Patch Tuesday release since July 2024 had included zero-day vulnerabilities, averaging 3.5 per month across this extended period . This unprecedented streak had placed enormous pressure on IT security teams, forcing constant emergency patch deployments and disrupting planned maintenance windows.
The absence of zero-days in May 2026 is attributed in part to enhanced vulnerability discovery through AI-powered security research initiatives like Anthropic’s Project Glasswing, which has helped identify and remediate vulnerabilities before they reach production environments . Microsoft’s Windows Attack Research and Protection (WARP) team is credited with discovering multiple critical vulnerabilities in this release, demonstrating the effectiveness of proactive threat hunting .
For system administrators, this clean release offers a rare opportunity to deploy patches according to planned schedules rather than emergency response protocols, allowing for proper testing cycles and controlled rollouts across production environments.
Critical Vulnerabilities Requiring Immediate Action
The May 2026 release includes 16 critical-severity vulnerabilities that demand immediate remediation, with the most severe threats targeting core infrastructure components. CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon with a CVSS score of 9.8, represents the highest priority for domain controller administrators. This flaw requires no privileges or user interaction, and attack complexity is low, potentially giving attackers SYSTEM privileges on domain controllers through specially crafted network requests. CVE-2026-41096, another 9.8-rated critical RCE in Windows DNS Client, could allow attacker-controlled DNS servers to send malicious responses that corrupt memory and enable remote code execution . CVE-2026-41103, a critical elevation of privilege vulnerability with a CVSS score of 9.1 affecting Microsoft SSO Plugin for Jira and Confluence, allows unauthorized attackers to impersonate existing users by presenting forged credentials, effectively bypassing Entra ID authentication .
Microsoft Office faces multiple critical threats including CVE-2026-40364 (type confusion), CVE-2026-40361 (use-after-free), CVE-2026-40363 (heap overflow), CVE-2026-40366 (use-after-free), CVE-2026-40358 (use-after-free), and CVE-2026-42831 (RCE), all rated 8.8 and exploitable through malicious document previews . Azure services are impacted by CVE-2026-33109 and CVE-2026-33844, both rated 9.0, affecting Azure Managed Instance for Apache Cassandra through access control bypass and input validation vulnerabilities.
| CVE ID | CVSS Score | Affected Product | Attack Vector | Technical Impact |
|---|---|---|---|---|
| CVE-2026-41089 | 9.8 | Windows Netlogon | Network | Stack-based buffer overflow, SYSTEM privileges |
| CVE-2026-41096 | 9.8 | Windows DNS Client | Network | Memory corruption, RCE |
| CVE-2026-41103 | 9.1 | Microsoft SSO Plugin | Network | Credential forgery, authentication bypass |
| CVE-2026-33109 | 9.0 | Azure Cassandra | Network | Access control bypass |
| CVE-2026-33844 | 9.0 | Azure Cassandra | Network | Input validation, code execution |
| CVE-2026-40364 | 8.8 | Microsoft Office | Local | Type confusion, RCE |
| CVE-2026-40361 | 8.8 | Microsoft Office | Local | Use-after-free, RCE |
| CVE-2026-40363 | 8.8 | Microsoft Office | Local | Heap overflow, RCE |
Domain Controller and DNS Infrastructure Threats
Domain controllers and DNS infrastructure face particularly severe threats in the May 2026 release, requiring urgent attention from network administrators. CVE-2026-41089, the Windows Netlogon buffer overflow vulnerability, poses an existential risk to Active Directory environments, as domain controllers are the core identity infrastructure for enterprise networks. A successful exploit could compromise authentication systems, expose credentials, enable broad lateral movement across the network, and disrupt access to business-critical systems . The vulnerability can be triggered by an unauthenticated attacker sending malicious network requests to Windows Server systems acting as domain controllers, with no user interaction required and low attack complexity . CVE-2026-41096 targets the Windows DNS Client implementation, a core networking service used across enterprise environments, meaning exploitation could impact a large number of systems rapidly and lead to widespread endpoint compromise, ransomware deployment, credential harvesting, and operational disruption across corporate networks . Patches are available for all versions of Windows Server from 2012 onwards, and Rapid7 security researchers urge anyone responsible for securing a domain controller to prioritize these vulnerabilities for immediate remediation . Organizations should deploy patches to domain controllers during the next available maintenance window, test DNS and Netlogon services thoroughly post-deployment, and monitor authentication logs for suspicious activity patterns.
Microsoft Office and SharePoint Remote Code Execution Risks
Microsoft Office applications face an unprecedented concentration of critical remote code execution vulnerabilities in the May 2026 release, with multiple flaws exploitable through document preview panes without requiring users to fully open malicious files. CVE-2026-40364 (Word type confusion, CVSS 8.8), CVE-2026-40361 (Word use-after-free, CVSS 8.8), CVE-2026-40363 (Office heap overflow, CVSS 8.8), CVE-2026-40366 (Word use-after-free, CVSS 8.8), CVE-2026-40358 (Office use-after-free, CVSS 8.8), and CVE-2026-42831 (Office RCE, CVSS 8.8) all allow unauthenticated attackers to execute arbitrary code locally when users open or preview specially crafted documents. The preview pane exploitation vector is particularly concerning because many organizations enable this feature by default, allowing attackers to compromise systems simply by getting a malicious file to appear in the victim’s file explorer or email client.
CVE-2026-40365 affects Microsoft SharePoint Server with a CVSS score of 8.8, allowing authenticated attackers with at least Site Owner privileges to perform network-based attacks that remotely execute code on SharePoint servers through insufficient access control granularity. CVE-2026-35421, a critical heap-based buffer overflow in Windows GDI with CVSS 8.8, can be triggered by opening specially crafted Enhanced Metafile (EMF) files using Microsoft Paint, affecting the graphics rendering subsystem.
| CVE ID | Component | CVSS | Vulnerability Type | User Interaction | Exploitation Vector |
|---|---|---|---|---|---|
| CVE-2026-40364 | Microsoft Word | 8.8 | Type Confusion | Required | Preview pane exploitation |
| CVE-2026-40361 | Microsoft Word | 8.8 | Use-After-Free | Required | Preview pane exploitation |
| CVE-2026-40363 | Microsoft Office | 8.8 | Heap Overflow | Required | Preview pane exploitation |
| CVE-2026-40366 | Microsoft Word | 8.8 | Use-After-Free | Required | Preview pane exploitation |
| CVE-2026-40358 | Microsoft Office | 8.8 | Use-After-Free | Required | Preview pane exploitation |
| CVE-2026-42831 | Microsoft Office | 8.8 | RCE | Required | Preview pane exploitation |
| CVE-2026-40365 | SharePoint Server | 8.8 | RCE | None (authenticated) | Network-based attack |
| CVE-2026-35421 | Windows GDI | 8.8 | Heap Buffer Overflow | Required | Crafted EMF file via Paint |
Organizations should update Microsoft Office and SharePoint immediately, communicate with users about the risks of opening email attachments, disable preview panes in high-risk environments, and validate all Office suite components post-deployment.
Azure and Cloud Services Critical Vulnerabilities
Azure services face critical security exposures in May 2026, requiring immediate attention from cloud infrastructure teams. CVE-2026-42826 is the highest-rated flaw this month affecting Azure DevOps, an information disclosure vulnerability with a perfect CVSS score of 10.0, representing the maximum severity rating . Although Microsoft provided limited technical details, the 10.0 score indicates critical risk for organizations storing enterprise data in Azure DevOps repositories, and patches should be applied immediately . CVE-2026-42898 and CVE-2026-42833, both rated 8.8, affect Microsoft Dynamics 365 On-Premises through poor code generation control, allowing authenticated attackers with low privileges to execute code over the network by manipulating process session data within Dynamics CRM . These vulnerabilities pose serious enterprise risk as attackers with only basic access could turn business application servers into remote execution platforms, potentially exposing customer records, workflows, financial information, and connected business systems [4]. CVE-2026-33109 and CVE-2026-33844, both rated 9.0, target Azure Managed Instance for Apache Cassandra through access control bypass and input validation vulnerabilities, allowing authorized attackers to execute code over the network [5]. Additional Azure components affected include Azure Cloud Shell, Azure AI Foundry, Azure Entra ID, Azure Connected Machine Agent, Azure Notification Service, Azure Logic Apps, and Azure Monitor Agent [1]. Cloud administrators should prioritize patching Azure DevOps environments, validate Dynamics 365 access controls, test Cassandra instance security configurations, and monitor Azure service logs for suspicious authentication patterns.
Affected Products and System Coverage
The May 2026 Patch Tuesday impacts over 60 distinct Microsoft products and components across Windows operating systems, productivity applications, cloud services, and development tools. Windows client operating systems receive comprehensive updates: Windows 11 versions 25H2 and 24H2 through KB5089549 (build 26200.8457 and 26100.8457 respectively, addressing 137 CVEs), Windows 11 23H2 through KB5087420 (137 CVEs), and Windows 10 ESU and LTSC 2021 through KB5087544 (build 19045.7291 and 19044.7291, addressing 120 CVEs). Windows Server infrastructure receives updates through KB5087537 for Windows Server 2016 (build 14393.914, 46 CVEs) with prerequisite Servicing Stack Update KB5088064 required before installation.
Core Windows components affected include Windows Netlogon, Windows DNS Client, Windows GDI, Windows Kernel, Windows SMB Client, Windows Hyper-V, Windows Remote Desktop, Windows Secure Boot, Windows TCP/IP, Windows Kernel-Mode Drivers, and numerous other system-level services. Microsoft Office products spanning Word, Excel, PowerPoint, SharePoint, and Office Click-To-Run require updates, alongside cloud services including Azure DevOps, Azure Cassandra, Azure Entra ID, Dynamics 365 (both cloud and on-premises), M365 Copilot, M365 Copilot for Desktop, Power Automate, and SQL Server. Development tools affected include Visual Studio Code, GitHub Copilot, and .NET/ASP.NET Core frameworks.
Organizations should inventory their Microsoft product deployments against this comprehensive list to ensure complete patch coverage across their environments.
Patch Download Links and KB Article References
Microsoft provides direct download links through the Microsoft Update Catalog for all May 2026 security updates, enabling IT administrators to download patches for offline deployment, WSUS integration, and manual installation scenarios. Organizations should access these resources to begin controlled patch deployment across their environments, following established testing protocols before production rollout.
| Product/Version | KB Article | Build Number | CVE Count | Download URL |
|---|---|---|---|---|
| Windows 11 25H2/24H2 | KB5089549 | 26100.2033 | 59 | https://www.catalog.update.microsoft.com/Search.aspx?q=KB5089549 |
| Windows 11 23H2 | KB5087420 | 22631.4602 | 59 | https://www.catalog.update.microsoft.com/Search.aspx?q=KB5087420 |
| Windows 10 ESU/LTSC | KB5087544 | 19045.5310 | 59 | https://www.catalog.update.microsoft.com/Search.aspx?q=KB5087544 |
| Windows Server 2016 | KB5087537 | 14393.7539 | 51 | https://www.catalog.update.microsoft.com/Search.aspx?q=KB5087537 |
| Windows Server 2016 SSU | KB5088064 | N/A | N/A | https://www.catalog.update.microsoft.com/Search.aspx?q=KB5088064 |
Deployment Guidance and Prioritization Strategy
Organizations should adopt a risk-based deployment approach for May 2026 patches, prioritizing systems based on vulnerability severity, exposure risk, and business criticality.
Immediate Priority Deployments
• Domain Controllers (All Windows Server Versions): Critical vulnerabilities CVE-2026-41089 and CVE-2026-41096 affect Netlogon and DNS Client services. Deploy KB5089549 or applicable updates immediately. Test DNS and Netlogon services post-deployment. Verify Active Directory replication. Monitor authentication logs for anomalies.
• Azure Cassandra Production Instances: CVE-2026-33109 and CVE-2026-33844 require immediate patching. Apply Azure Cassandra updates. Validate access controls. Test input validation mechanisms.
• SSO Infrastructure (Jira/Confluence): CVE-2026-41103 enables authentication bypass and session hijacking. Update SSO plugins. Test credential flows. Monitor authentication logs for impersonation attempts.
High Priority Deployments
• Microsoft Office Workstations: Multiple critical RCE vulnerabilities (CVE-2026-40364, CVE-2026-40361, CVE-2026-40363, CVE-2026-40366, CVE-2026-40358, CVE-2026-42831) affect all Office installations. Test Office applications post-deployment. Communicate email attachment risks to users. Validate all Office suite components (Word, Excel, PowerPoint, Outlook).
• SharePoint Production Servers: CVE-2026-40365 enables RCE through deserialization. Test access controls. Validate file upload/download functionality. Check custom web parts.
• Remote Desktop Servers: Deploy KB5089549 for Remote Desktop Session Host servers.
• Windows Server 2016 Infrastructure: Deploy prerequisite SSU KB5088064 before installing KB5087537. Validate Server Manager functionality.
Standard Priority Deployments
• Windows 10 Workstations: Deploy KB5087544 through normal deployment windows following standard testing procedures.
• Secure Boot Certificate Update: Systems requiring Secure Boot certificate updates have a deadline of June 26, 2026 for certificate validation. Plan deployment well in advance of this deadline.
Deployment Best Practices
Organizations should establish robust deployment procedures to ensure successful patch implementation:
• Establish test groups representing diverse hardware and software configurations
• Monitor for application compatibility issues during pilot deployments
• Validate BitLocker behavior on encrypted systems before broad deployment
• Maintain rollback capabilities throughout the deployment process
• Document any issues encountered and resolutions applied
• Communicate deployment schedules and potential impacts to end users
Business Impact and Risk Mitigation Recommendations
The May 2026 Patch Tuesday presents both opportunities and obligations for enterprise IT security teams balancing operational continuity with risk mitigation. The absence of actively exploited zero-days provides a strategic deployment window, allowing organizations to follow planned testing and rollout schedules rather than emergency response protocols, reducing the risk of production disruptions from hasty deployments . However, the concentration of critical vulnerabilities affecting core infrastructure components – domain controllers, DNS services, and authentication systems – means delayed patching significantly elevates enterprise risk exposure to credential theft, lateral movement, and domain-wide compromise scenarios .
Organizations face particularly acute business risk from the Microsoft Office RCE vulnerabilities exploitable through preview panes, as these attack vectors require minimal user interaction and can spread rapidly through email-based attacks targeting large user populations. SharePoint vulnerabilities pose direct threats to collaboration platforms housing sensitive business documents, intellectual property, and customer data. Azure and Dynamics 365 vulnerabilities create exposure pathways that could compromise business application servers, CRM systems, customer records, financial workflows, and connected enterprise systems .
The approaching June 26, 2026 Secure Boot certificate expiration deadline adds urgency, as systems without updated certificates may fail to boot after this date, potentially causing widespread operational disruptions . IT leaders should communicate patch deployment timelines to business stakeholders, allocate resources for accelerated testing cycles, coordinate with application owners to validate compatibility, establish rollback procedures for critical systems, and document compliance status for audit purposes.
Organizations that prioritize immediate deployment of critical patches, complete Secure Boot certificate validation before the June deadline, and maintain comprehensive patch management documentation will significantly reduce their attack surface and demonstrate due diligence in security governance.
