Microsoft released its May 2026 Patch Tuesday security updates on May 12, addressing vulnerabilities in Windows, Microsoft Office and other products. Microsoft said it was not aware of active exploitation or public disclosure of the vulnerabilities at the time of release.
Assessments differed on the size of the release. A reported release-day tally listed 120 vulnerabilities, including 17 rated Critical. Security company Rapid7 counted 137 vulnerabilities, while the Zero Day Initiative counted 138 new May CVEs, including 30 rated Critical.
The 120-vulnerability tally excluded Microsoft fixes issued earlier in May and separate Microsoft Edge and Chromium browser updates. Rapid7’s count also excluded browser vulnerabilities, so browser exclusions alone do not establish a reconciliation between the figures.
The reported 120-vulnerability breakdown listed 61 elevation-of-privilege flaws, 31 remote code execution flaws, 14 information disclosure flaws, eight denial-of-service flaws and six security feature bypass flaws. Within that tally, the 17 Critical issues comprised 14 remote code execution vulnerabilities, two elevation-of-privilege vulnerabilities and one information disclosure vulnerability.
Office and Windows vulnerabilities
Reported fixes included remote code execution vulnerabilities in Microsoft Office, Word and Excel. Satnam Narang, senior staff research engineer at Tenable, said malicious documents could trigger some of the Word vulnerabilities through the Preview Pane, without the recipient opening the document.
Other reported fixes addressed remote code execution vulnerabilities in Windows GDI and Microsoft SharePoint Server. The SharePoint issue, CVE-2026-40365, was described as allowing an authenticated attacker to execute code through a network-based attack.
The Windows DNS Client vulnerability, CVE-2026-41096, was reported to involve a specially crafted DNS response. Microsoft said the flaw could allow an attacker to run code remotely without authentication in certain configurations; it did not specify those configurations in the quoted explanation.
Windows 11 cumulative updates
Microsoft released cumulative update KB5089549 for Windows 11 versions 25H2 and 24H2, bringing their operating system builds to 26200.8457 and 26100.8457, respectively. Windows 11 version 23H2 received KB5087420, bringing its build to 22631.7079.
Microsoft’s release notes state that the cumulative updates include security fixes and improvements, along with non-security changes from the previous month’s optional preview releases.
