Microsoft Patch Tuesday May 2026: 120 Vulnerabilities Fixed

Overview: 120 CVEs, 17 Rated as Critical

With the May 2026 Patch Tuesday, Microsoft closed a total of 120 security vulnerabilities across its entire product portfolio on 12 May 2026. The vendor rates 17 of these vulnerabilities as “Critical”. In contrast to many previous months, current information indicates no zero-days are included — neither publicly known nor actively exploited vulnerabilities were reported at the time of release.

The focus is clearly on document-based attack vectors in Office and Word, as well as on network-exposed authentication and name resolution components in the Windows server stack. Seven critical CVEs affect Windows components, six the Office suite, and three SharePoint & Services.

Netlogon and DNS Client: Pre-Auth RCE in the Authentication Stack

From an operational standpoint, the most dangerous flaws of the month affect two network-exposed Windows server components that play a central role in Active Directory operations. Both enable Remote Code Execution without authentication — a classic wormable profile.

According to a Qualys analysis, CVE-2026-41089 is based on a stack-based buffer overflow in Netlogon, which can be exploited via a specially crafted network request to a Domain Controller. CVE-2026-41096, on the other hand, is triggered via an attacker-controlled DNS server: a specially constructed DNS response sent to a requesting Windows client leads to code execution. This makes the DNS client flaw dangerous even in scenarios where Domain Controllers themselves are not directly reachable.

Office & Word: Seven Critical RCEs, One Preview-Pane Vector

The May release contains seven critical RCE flaws in Office and Word. They are predominantly triggered by crafted documents — the classic way is by opening them, but in one case particularly critically via the Preview Pane in Windows Explorer or Outlook. This reduces the user interaction required for exploitation to merely selecting the file.

SharePoint Server & Dynamics 365: On-Premises Applications in Focus

On the on-premises side, Microsoft is addressing five SharePoint RCE vulnerabilities as well as a critical flaw in Dynamics 365 On-Premises. While the SharePoint flaws predominantly require authenticated vectors, the attack surface for internet-facing collaboration servers is typically considerably larger than for pure LAN deployments — for example through self-service accounts, federations or third-party access.

# Read build versions of the SharePoint farm
Get-SPFarm | Select-Object BuildVersion

# Patch status of all servers in the farm
Get-SPProduct | Select-Object ProductName, Patchable, PatchableUnitDisplayNames

# Cumulative updates for SharePoint Server 2019
Get-WmiObject -Class Win32_QuickFixEngineering |
  Where-Object { $_.HotFixID -match 'KB' } |
  Sort-Object InstalledOn -Descending |
  Select-Object -First 10 HotFixID, Description, InstalledOn

Recommended Patch Prioritisation

Since there is no zero-day pressure, this month's rollout can be planned in an orderly fashion. The decisive factor is the exposure of the respective component: authentication stack before internet-facing applications before endpoints before passive infrastructure.

# Current KB patches from the last 30 days
Get-HotFix |
  Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-30) } |
  Sort-Object InstalledOn -Descending |
  Format-Table HotFixID, Description, InstalledOn -AutoSize

# Windows Update history via PSWindowsUpdate (module must be installed)
Get-WUHistory | Select-Object Date, Title, Result -First 15

# Quickly identify Domain Controllers
Get-ADDomainController -Filter * |
  Select-Object Name, OperatingSystem, OperatingSystemVersion

Conclusion: A Quiet Month Without Zero-Day — But No Reason to Relax

The May 2026 release is one of the more extensive Patch Tuesdays in quantitative terms, but qualitatively more relaxed than previous months due to the absence of actively exploited zero-days. This gives security teams room for an orderly, tested rollout — but does not mean the flaws are trivial. In particular, the Netlogon RCE and the Word Preview Pane vector are classic building blocks for future attack chains and are likely to be the subject of public exploit demos.

Our recommendation: prioritise domain-relevant servers, followed by internet-exposed services and Office clients, and take this release as an opportunity to structurally review your vulnerability management process — not just a single patch cycle.