MS Patches 120 Vulnerabilities in May 2026 Update

On May 12, MS released fixes for 120 vulnerabilities, notably without disclosing any zero-days. However, enterprise defenders are still required to address a wide range of risks, including those affecting document handling, identity infrastructure, collaboration platforms, virtualization environments, and standard Windows networking.

Key Highlights of May's Security Package

The May 2026 Patch Tuesday update included 17 critical vulnerabilities, 14 of which were remote code execution (RCE) flaws. Organizations must act swiftly to assess and deploy these updates across their systems. Patch managers face a critical challenge: determining which business systems can accommodate first-wave updates without triggering outages elsewhere.

Complexity in Enterprise Patching

Enterprise patching teams confront a multifaceted "patch-order problem," as this month’s updates span various systems, including:

• Office endpoints
• Domain controllers
• DNS-dependent Windows systems
• SharePoint deployments
• Hyper-V hosts

Each of these systems is often managed by different teams, with distinct patching schedules, rollback procedures, and maintenance windows. Even when a single MS release covers all these areas, coordinating updates remains an operational challenge.

Comparison with Recent Patch Cycles

In previous months:

• February addressed six active zero-days.
• April involved 167 vulnerabilities, including two zero-days.

While May 2026 lacks zero-day disclosures, it does not reduce the workload for defenders. Each recent update has required trade-offs between emergency rollout speed, outage risk, and verification time for critical systems, adding to the cumulative prioritization burden.

Breakdown of Vulnerabilities in May 2026

MS’s May release included the following:

• 31 remote code execution vulnerabilities
• 61 elevation-of-privilege (EoP) issues
• 14 information disclosure flaws
• 8 denial-of-service (DoS) vulnerabilities
• 6 security feature bypass issues
• 13 spoofing vulnerabilities

Among these, RCE bugs remain a priority as they enable attackers to execute arbitrary code, while EoP vulnerabilities add operational complexity by affecting permissions, administrator boundaries, and user-to-system transitions. Security teams must validate and address these vulnerabilities before moving from pilot testing to broad deployment.

No Zero-Days in May: A Rare Occurrence

May 2026 marks the first monthly MS security update in nearly two years without any exploited or publicly disclosed zero-day vulnerabilities. Over the past 22 months, MS has averaged 3.5 zero-days per month, making this month quieter but not necessarily lighter in terms of remediation efforts.

Office Vulnerabilities: A Persistent Concern

Despite the absence of zero-days, Office-related vulnerabilities remain a major focus. MS addressed flaws in Office, Word, and Excel that could lead to RCE, with some tied to risks from the Preview Pane. Since employees frequently preview documents such as invoices, resumes, and shared files, these vulnerabilities necessitate a broader patching effort beyond individual application updates.

Additionally, May’s update includes CVE-2026-35421, a vulnerability in Paint where opening a malicious Enhanced Metafile could enable code execution. Endpoint teams must also prioritize fixes like CVE-2026-40367, CVE-2026-40366, and CVE-2026-40364, affecting laptops, shared workstations, and virtual desktops.

Infrastructure-Level Risks

Several vulnerabilities in May’s update pose significant risks to enterprise infrastructure:

• CVE-2026-41096: A Windows DNS Client heap-based buffer overflow vulnerability with a CVSS score of 9.8. This RCE flaw can be exploited remotely without authentication or user interaction, impacting a wide range of Windows systems.
• CVE-2026-41089: A critical issue in Windows Netlogon with a CVSS score of 9.8, allowing unauthenticated attackers to execute code remotely on domain controllers. Given the potential for authentication failures, patching domain controllers requires extra caution to avoid disrupting access to business-critical services.

SharePoint and Hyper-V Concerns

SharePoint vulnerabilities remain a concern for enterprise security teams. CVE-2026-40365 exposes SharePoint servers to RCE attacks, albeit requiring Site Owner privileges. While this narrows the attacker pool, defenders must evaluate privileged-user exposure, external publishing, and collaboration sprawl to mitigate risks.

In virtualized environments, CVE-2026-40402 in Hyper-V introduces a severe risk, allowing attackers to escape from a guest VM to the host environment and gain SYSTEM privileges. This kind of boundary failure impacts multiple workloads simultaneously, requiring immediate attention from virtualization teams.

Operational Impacts of May 2026 Update

May’s update pushes teams managing Office endpoints, DNS-related Windows systems, domain controllers, SharePoint servers, and Hyper-V hosts toward a unified maintenance window. Despite the absence of zero-days, the scope and complexity of this month’s vulnerabilities make it operationally demanding for enterprises to address.

Once your system is ready, the next step is the tools you use every day. An Office 2024 OEM key is a cost-effective way to get the full MS Office suite without a subscription. Whokeys.com offers Office 2024 OEM key with instant delivery and activation guarantee — a smart add-on for any new setup.