Microsoft Patches 120 Flaws, 29 Critical RCEs in May 2026 Update
Key Takeaways Microsoft released 120 patches for various vulnerabilities in its May 2026 Patch Tuesday update. Among these, 29 critical Remote Code Execution (RCE) flaws were addressed across...
Key Takeaways
- Microsoft released 120 patches for various vulnerabilities in its May 2026 Patch Tuesday update.
- Among these, 29 critical Remote Code Execution (RCE) flaws were addressed across Windows, Office, Azure, and developer tools.
- No zero-day vulnerabilities were reported as actively exploited in the wild or publicly disclosed prior to this release.
- Organizations should prioritize patching internet-facing systems, core networking components, and applications susceptible to RCE.
Microsoft’s May 2026 Patch Tuesday Addresses 120 Flaws, Including 29 Critical RCEs
Microsoft’s May 2026 Patch Tuesday cycle brings a substantial set of security updates, targeting 120 vulnerabilities across its extensive product ecosystem. The comprehensive release covers critical components within Windows, Office, Azure, various developer tools, and Microsoft 365 applications. A significant highlight of this month’s bulletin is the mitigation of 29 Critical-rated Remote Code Execution (RCE) vulnerabilities, underscoring a strong focus on enterprise security.
Table Of Content
- Key Takeaways
- Microsoft’s May 2026 Patch Tuesday Addresses 120 Flaws, Including 29 Critical RCEs
- Critical Remote Code Execution Flaws Dominate Patch Tuesday
- Windows Core Components and Virtualization Under Scrutiny
- AI, Developer Tools, and Azure See Important Updates
- What You Should Do
- Vulnerability Details
Unlike previous patch cycles, Microsoft confirmed that no zero-day vulnerabilities were found to be under active exploitation or publicly disclosed before the release of these updates. Despite this, the broad range of affected components—from DNS and Netlogon to Office applications and Wi-Fi drivers—necessitates a diligent approach from defenders, as the potential attack surface remains considerable.
| Vulnerability Type | Count |
|---|---|
| Elevation of Privilege | 61 |
| Security Feature Bypass | 6 |
| Remote Code Execution (RCE) | 31 |
| Information Disclosure | 14 |
| Denial of Service (DoS) | 8 |
| Spoofing | 13 |
Critical Remote Code Execution Flaws Dominate Patch Tuesday
While no zero-day exploits were identified, a significant portion of the most severe vulnerabilities are RCE flaws that could lead to complete system compromise if left unpatched. These vulnerabilities primarily affect network-exposed services and document-processing components.
Key areas requiring immediate attention include Microsoft Dynamics 365 on-premises (CVE-2026-42898, CVE-2026-42833), several RCEs impacting Microsoft Office and Word (e.g., CVE-2026-42831, CVE-2026-40363, CVE-2026-40358, and multiple Word-specific CVEs), Windows DNS Client (CVE-2026-41096), Netlogon (CVE-2026-41089), Windows Graphics/Win32k (CVE-2026-40403), Windows GDI (CVE-2026-35421), Windows Native Wi-Fi Miniport (CVE-2026-32161), and Microsoft SharePoint Server (CVE-2026-40365 and related CVEs).
Many of these vulnerabilities reside in components that frequently interact with untrusted network traffic, malicious Office documents, or browser-like rendering pathways. This makes them particularly attractive targets for adversaries initiating phishing attacks or attempting lateral movement within compromised networks.
Windows Core Components and Virtualization Under Scrutiny
The May updates also address numerous vulnerabilities within fundamental Windows networking and kernel-mode components, elevating the risk profile for both domain-joined and internet-facing systems.
The Windows DNS Client RCE (CVE-2026-41096) and Netlogon RCE (CVE-2026-41089) are especially notable. Successful exploitation of these flaws could grant unauthenticated or low-privileged attackers the ability to execute arbitrary code in highly sensitive areas of Windows’ authentication and name resolution infrastructure, reminiscent of past impactful vulnerabilities like SigRed and Zerologon.
Additional RCE and elevation-of-privilege vulnerabilities are spread across vital subsystems such as TCP/IP, the Volume Manager Extension driver, various kernel-mode drivers, Win32k, GDI, and the Cloud Files and Telephony subsystems. These individual flaws could potentially be chained together to create more potent attack vectors.
Furthermore, a critical privilege escalation fix has been issued for Windows Hyper-V (CVE-2026-40402). This is a crucial update for environments leveraging multi-tenant or private cloud infrastructures, where a guest-to-host escape could lead to widespread compromise.
Several Secure Boot and security-feature bypass bugs, including those affecting TCP/IP and Secure Boot itself, highlight a continuous effort by attackers to circumvent Microsoft’s core defensive mechanisms, not just exploit application logic.
AI, Developer Tools, and Azure See Important Updates
This month’s Patch Tuesday also underscores the expanding attack surface presented by the deep integration of AI and cloud-connected development into enterprise operations, as detailed in the Microsoft Security Response Center update guide.
Microsoft has released patches for spoofing and security-feature bypass issues in M365 Copilot for Desktop and Android, GitHub Copilot with Visual Studio, and Azure Machine Learning notebooks. These vulnerabilities raise concerns about potential prompt-driven social engineering, data exfiltration, or the injection of malicious content through ostensibly trusted AI interfaces.
While these AI-related flaws are rated as Important rather than Critical, their exploitation could significantly amplify the impact of otherwise medium-risk bugs, especially given AI assistants’ proximity to sensitive source code, documents, and communication histories.
Developer tooling also features prominently, with Visual Studio Code receiving a suite of fixes for elevation of privilege, information disclosure, RCE, and security feature bypass vulnerabilities (CVE-2026-41613 through CVE-2026-41610 and CVE-2026-41109). Concurrently, .NET and ASP.NET Core patches address elevation of privilege, tampering, and denial-of-service conditions.
Azure Monitor Agent, Logic Apps, Connected Machine Agent, Windows Admin Center (including its Azure Portal integration), and Dynamics 365 Business Central are also affected by vulnerabilities addressed in this bulletin. This confirms that organizations utilizing Azure-centric and hybrid-cloud deployments should treat these May updates with high priority.
What You Should Do
- Prioritize Critical RCEs: Immediately patch internet-facing systems and high-value services, including Microsoft Dynamics 365 on-premises, SharePoint, and Office/Word RCEs.
- Address Core Windows Components: Follow up by patching Windows DNS Client, Netlogon, Windows GDI/Win32k graphics components, and the Native Wi-Fi Miniport driver.
- Update Virtualization Platforms: Schedule maintenance windows for Hyper-V updates, especially in multi-tenant or private cloud environments.
- Consider AI and Developer Tooling: Do not overlook patches for AI- and workflow-related fixes impacting Copilot, Teams, and Azure-based automation, even if their severity is marked as Important.
- Regular Patch Management: Ensure a robust patch management process is in place for all Microsoft products and services.
Vulnerability Details
| CVE ID | Impact | Title |
| CVE-2026-42899 | Denial of Service | ASP.NET Core Denial of Service Vulnerability |
| CVE-2026-42898 | Remote Code Execution | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-42896 | Elevation of Privilege | Windows DWM Core Library Elevation of Privilege Vulnerability |
| CVE-2026-42893 | Tampering | Microsoft Outlook for iOS Tampering Vulnerability |
| CVE-2026-42833 | Remote Code Execution | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-42832 | Spoofing | Microsoft Office Spoofing Vulnerability |
| CVE-2026-42831 | Remote Code Execution | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-42830 | Elevation of Privilege | Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability |
| CVE-2026-42825 | Elevation of Privilege | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-42823 | Elevation of Privilege | Azure Logic Apps Elevation of Privilege Vulnerability |
| CVE-2026-41614 | Spoofing | M365 Copilot for Desktop Spoofing Vulnerability |
| CVE-2026-41613 | Elevation of Privilege | Visual Studio Code Elevation of Privilege Vulnerability |
| CVE-2026-41612 | Information Disclosure | Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-41611 | Remote Code Execution | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-41610 | Security Feature Bypass | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-41109 | Security Feature Bypass | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-41103 | Elevation of Privilege | Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability |
| CVE-2026-41102 | Spoofing | Microsoft PowerPoint for Android Spoofing Vulnerability |
| CVE-2026-41101 | Spoofing | Microsoft Word for Android Spoofing Vulnerability |
| CVE-2026-41100 | Spoofing | Microsoft 365 Copilot for Android Spoofing Vulnerability |
| CVE-2026-41097 | Security Feature Bypass | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2026-41096 | Remote Code Execution | Windows DNS Client Remote Code Execution Vulnerability |
| CVE-2026-41095 | Elevation of Privilege | Data Deduplication Elevation of Privilege Vulnerability |
| CVE-2026-41094 | Remote Code Execution | Microsoft Data Formulator Remote Code Execution Vulnerability |
| CVE-2026-41089 | Remote Code Execution | Windows Netlogon Remote Code Execution Vulnerability |
| CVE-2026-41088 | Elevation of Privilege | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-41086 | Elevation of Privilege | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability |
| CVE-2026-40421 | Information Disclosure | Microsoft Word Information Disclosure Vulnerability |
| CVE-2026-40420 | Elevation of Privilege | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40419 | Elevation of Privilege | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40418 | Elevation of Privilege | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40417 | Elevation of Privilege | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
| CVE-2026-40415 | Remote Code Execution | Windows TCP/IP Remote Code Execution Vulnerability |
| CVE-2026-40414 | Denial of Service | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40413 | Denial of Service | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40410 | Elevation of Privilege | Windows SMB Client Elevation of Privilege Vulnerability |
| CVE-2026-40408 | Elevation of Privilege | Windows WAN ARP Driver Elevation of Privilege Vulnerability |
| CVE-2026-40407 | Elevation of Privilege | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2026-40406 | Information Disclosure | Windows TCP/IP Information Disclosure Vulnerability |
| CVE-2026-40405 | Denial of Service | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40403 | Remote Code Execution | Windows Graphics Component Remote Code Execution Vulnerability |
| CVE-2026-40402 | Elevation of Privilege | Windows Hyper-V Elevation of Privilege Vulnerability |
| CVE-2026-40401 | Denial of Service | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40399 | Elevation of Privilege | Windows TCP/IP Elevation of Privilege Vulnerability |
| CVE-2026-40398 | Elevation of Privilege | Windows Remote Desktop Services Elevation of Privilege Vulnerability |
| CVE-2026-40397 | Elevation of Privilege | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2026-40382 | Elevation of Privilege | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-40381 | Elevation of Privilege | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
| CVE-2026-40380 | Remote Code Execution | Windows Volume Manager Extension Driver Remote Code Execution Vulnerability |
| <a target="_blank" rel="noreferrer noopener" href="https://www.google.com/url
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.