May’s Patch Tuesday hauls out 132 CVEs

In another banner month for the AI-finder era, Microsoft on Tuesday released 132 patches affecting 20 product families. Twenty-nine of the addressed issues are considered by Microsoft to be of Critical severity, and 13 issues are expected to be exploited within the next 30 days. Forty-three have a CVSS base score of 8.0 or higher, including one with a “perfect” 10.0. Fourteen CVEs, including the 10.0 item mentioned above, were patched by Microsoft in advance of Patch Tuesday. Incredibly, none were publicly disclosed as of release day and none are known to be under active exploit in the wild. 

For the second month in a row, the release includes massive set of advisories – 145 of them. As ever, the majority are Edge-related, assigned by Chrome, and patched days in advance of Patch Tuesday. One comes from AMD and was likewise already addressed. Thirteen, all affecting Adobe Commerce, were issued by Adobe.

Various of this month’s issues are amenable to direct detection by Sophos protections, and we include information on those in the usual table below. We are as always including at the end of this post appendices listing all Microsoft’s patches sorted by severity (Appendix A), by predicted exploitability timeline and CVSS Base score (Appendix B), and by product family (Appendix C). Appendix D lists this month’s advisories. Appendix E provides a breakout of 66 CVEs affecting various versions of Windows Server, including the advisory from AMD that is otherwise not counted in the patch totals for the month. Our analysis of CWE (Common Weakness Enumeration) information made available for this month’s patches appears in Appendix F.

By the numbers

• Total CVEs: 132
• Publicly disclosed: 0
• Exploit detected: 0
• Severity
  • Critical: 29
  • Important: 103
• Impact:
  • Denial of Service: 8
  • Elevation of Privilege: 59
  • Information Disclosure: 14
  • Remote Code Execution: 31
  • Security Feature Bypass: 6
  • Spoofing: 11
  • Tampering: 3
• CVSS base score 9.0 or greater: 14
• CVSS base score 8.0 or greater: 43

Figure 1: Elevation of Privilege issues once again account for the majority of the month’s CVEs, but nearly half of the Remote Control Execution CVEs are Critical-severity.

Products

As is our custom for this list, CVEs that apply to more than one product family are counted once for each family they affect. We note, by the way, that CVE names don’t always reflect affected product families closely. In particular, some CVEs names in the Office family may mention products that don’t appear in the list of products affected by the CVE, and vice versa. 

Figure 2: A hefty 20 families are covered in May’s Patch Tuesday release. The Critical-severity issue called “Confluence / Jira” covers an SSO plug-in for those tools, as described below.

Figure 3: The count of Elevation of Privilege CVEs passes 250, and Spoofing and Security Feature Bypass swap spots on the cumulative list of 2026 vulnerabilities. By way of comparison, as of this time last year Microsoft had addressed 470 CVEs.

Notable May updates

In addition to the issues discussed above, a few specific items merit attention. 

CVE-2026-41103 -- Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

There are 14 CVEs with a CVSS Base score of 9.0 or higher this month (with 11 of those also marked as Critical-severity), but the only one Microsoft thinks is more likely to be exploited in the next 30 days is this Critical-severity Elevation of Privilege issue, which involves an incorrect implementation of an authentication algorithm (CWE-303) – not far-fetched, since this involves SSO. The bug would permit an attacker to bypass authentication and sign in as a valid user. The specifically affected plug-ins are the Microsoft Confluence SAML SSO plugin and the Microsoft JIRA SAML SSO plugin.

CVE-2026-41089 -- Windows Netlogon Remote Code Execution Vulnerability
CVE-2026-41096 -- Windows DNS Client Remote Code Execution Vulnerability

Also in the over-9.0 CVSS Club with matching base scores of 9.8, these two CVEs both allow exploitation even by an unauthorized attacker.

CVE-2026-40358 -- Microsoft Office Remote Code Execution Vulnerability
CVE-2026-40361 -- Microsoft Word Remote Code Execution Vulnerability
CVE-2026-40363 -- Microsoft Office Remote Code Execution Vulnerability
CVE-2026-40364 -- Microsoft Word Remote Code Execution Vulnerability
CVE-2026-40366 -- Microsoft Word Remote Code Execution Vulnerability
CVE-2026-40367 – Microsoft Word Remote Code Execution Vulnerability

All six of these Remote Code Execution vulnerabilities can be exploited via Preview Pane. Of the six, CVE-2026-40361 and CVE-2026-40364 are thought by Microsoft to be more likely to be exploited within the first 30 days post-release.

CVE-2026-35432 -- Windows 11 Telnet Client Information Disclosure Vulnerability

Telnet. That is all. Yes, it’s still 2026.

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of May patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE. 

Elevation of Privilege (59 CVEs)

Remote Code Execution (31 CVEs)

Information Disclosure (14 CVEs)

Spoofing (11 CVEs)

Denial of Service (8 CVEs)

Security Feature Bypass (6 CVEs)

Tampering (3 CVEs)

Appendix B: Exploitability and CVSS

This is a list of the 13 May CVEs judged by Microsoft to be more likely to be exploited in the wild within the first 30 days post-release. The list is arranged by CVE.

These are the May CVEs with a Microsoft-assessed CVSS Base score of 8.0 or higher. They are arranged by score and further sorted by CVE. For more information on how CVSS works, please see our series on patch prioritization schema. 

Appendix C: Products Affected

This is a list of May’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family. All CVE titles are accurate as made available by Microsoft. For further information on why certain products may appear in titles and not product families (or vice versa), please consult Microsoft.

Windows (68 CVEs)

Office (16 CVEs)

365 (15 CVEs)

Azure (15 CVEs)

SharePoint (7 CVEs)

Visual Studio (7 CVEs)

Word (7 CVEs)

Copilot (5 CVEs)

.NET (4 CVEs)

Dynamics 365 (4 CVEs)

Excel (4 CVEs)

Teams (2 CVEs)

Confluence / Jira (1 CVE)

Data Formulator (1 CVE)

Outlook (1 CVE)

Partner Center (1 CVE)

Power Automate (1 CVE)

PowerPoint(1 CVE)

SQL (1 CVE)

Windows Admin Center (1 CVE)

Appendix D: Advisories and Other Products

There are 131 Edge-related advisories listed in May’s release, all but five from Chrome. Because the CVEs from Microsoft were (like the Chrome CVEs) patched before Patch Tuesday, and because this post is already shockingly long, we have massed all of them together in the very long table below.

Meanwhile, there are 13 updates from Adobe, all affecting Adobe Commerce - 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18. These are collectively addresseḍ as APSB26-49. 

Microsoft also issued the usual servicing stack updates this month (ADV990000).

Finally, there is one Important-severity CVE from AMD (CVE-2025-54518, CPU OP Cache Corruption) in this month’s set; we have covered it elsewhere in this post, including in the table below. Microsoft is releasing advisory information on this issue to state that the latest builds of windows protect against this cache-corruption vulnerability.

Appendix E: Affected Windows Server versions

This is a table of 66 CVEs in the May release affecting Windows Server versions 2012 through 2025. The table differentiates among major versions of the platform but doesn’t go into deeper detail (eg., Server Core). An “x” indicates that the CVE does not apply to that version. We include the Important-severity, Windows-touching advisory from AMD, since the Server versions they affect are known; those are indicated in this chart in blue.

Administrators are encouraged to use this appendix as a starting point to ascertain their specific exposure, as each reader’s situation, especially as it concerns products out of mainstream support, will vary. For specific Knowledge Base numbers, please consult Microsoft. 

Appendix F: Common Weakness Enumeration

As mentioned above, Microsoft now states which CWEs affect the CVEs they address. This month, we looked at which CWEs were most heavily represented in the dataset and compared them to last month’s inaugural numbers. The May dataset of 132 CVEs gave us 152 CWEs overall; 17 CVEs had two CVEs, and 3 had three CWEs. There were 49 unique CWEs, slightly more than last month’s 42. Once again CWE-416, Use After Free, leads the pack, though it accounts for just 18.42 percent of vulnerabilities rather than the commanding 28.57 percent in April’s haul. With just two months’ worth of data it’s too early to identify significant patterns yet, but we once again find ourselves looking at CWE-835 -- Loop with Unreachable Exit Condition ('Infinite Loop') and asking why the number for that couldn’t be either zero (0) or a sideways eight (∞).