Stay ahead of critical vulnerabilities with our breakdown of May 2026 month's Microsoft security patches.
Release Date: Tuesday, May 12, 2026
Release Time: 10:00 AM PST / 1:00 PM EST / 6:00 PM UTC
Status: Released
Last Updated: May 12, 2026
Microsoft has released its May 2026 Patch Tuesday security updates, addressing 118 CVEs across Windows, Office, Azure, and server products. This release marks a significant milestone: for the first time since June 2024, Microsoft has shipped a monthly security update with zero actively exploited or publicly disclosed zero-day vulnerabilities. While this represents positive progress, the release still includes 16 critical-severity vulnerabilities requiring immediate attention, and organizations have only 45 days remaining until the critical June 26, 2026 Secure Boot certificate expiration deadline.
Key Highlights:
Critical Priority Actions:
The absence of actively exploited zero-days provides a welcome reprieve, but organizations must use this window to accelerate patch deployment and complete Secure Boot certificate validation before the June 26 deadline.
Microsoft's May release addresses 118 unique CVEs (excluding AMD CPU vulnerability CVE-2025-54518, which was issued by AMD). The severity distribution breaks down as follows:
The concentration of critical vulnerabilities, though smaller in percentage than recent months, still requires urgent attention due to the potential for remote code execution and system compromise.
Elevation of Privilege vulnerabilities continue to dominate Microsoft's security landscape, accounting for nearly half of all patched issues:
The high proportion of EoP vulnerabilities reflects Microsoft's continued focus on addressing privilege escalation issues in Windows kernel and system components, which are frequently chained with other exploits in sophisticated attack campaigns.
May 2026 marks a significant milestone: this is the first Patch Tuesday since June 2024 without any actively exploited or publicly disclosed zero-day vulnerabilities. To understand the significance of this achievement, consider the Q1 2026 zero-day context:
While the absence of zero-days is positive news, organizations should not interpret this as a reduction in overall threat level. The 16 critical-severity vulnerabilities, particularly those assessed as "Exploitation More Likely" by Microsoft's Exploitability Index, still pose significant risk and require rapid deployment.
CVSS Score: 9.1 (Critical)
Exploitability Assessment: Exploitation More Likely
Attack Vector: Network
Privileges Required: None
User Interaction: Required
CVE-2026-41103 is an elevation of privilege vulnerability affecting Microsoft Single Sign-On Plugin for Jira and Confluence. The vulnerability exists in the authentication process, where an attacker can send a specially crafted response message during login to bypass Microsoft Entra ID authentication and sign in using a forged identity.
Technical Details:
The vulnerability stems from improper validation of authentication responses during the SSO process. An attacker positioned to intercept or manipulate authentication traffic can craft a malicious response that the plugin accepts as legitimate, effectively bypassing the intended authentication mechanism. This allows the attacker to impersonate any user without possessing valid credentials.
Impact:
Successful exploitation allows an attacker to:
The accessible information is limited by the permissions defined for the authorized user on the target servers, but in environments where users have broad access, the potential for data exposure and modification is significant.
Exploitation Scenario:
Remediation Priority: Immediate (Critical priority for organizations using Microsoft SSO Plugin with Jira or Confluence)
CVSS Score: 8.4 (Critical) for all four CVEs
Exploitability Assessment: CVE-2026-40361 and CVE-2026-40364 assessed as "Exploitation More Likely"
Attack Vector: Local (requires user interaction)
Privileges Required: None
User Interaction: Required
Microsoft addressed four critical remote code execution vulnerabilities in Microsoft Word that can be exploited through malicious document files. All four vulnerabilities are exploitable through the Preview Pane, meaning users do not need to open files for successful attacks.
Technical Details:
These vulnerabilities stem from improper handling of specially crafted Word documents. When a malicious file is processed (either opened or previewed), memory corruption occurs that allows an attacker to execute arbitrary code with the privileges of the current user. The Preview Pane attack vector is particularly concerning because it enables zero-click exploitation (users don't need to explicitly open files, merely selecting or previewing them triggers the vulnerability).
Impact:
Successful exploitation allows an attacker to:
Exploitation Scenario:
Remediation Priority: Critical (Office Preview Pane vulnerabilities require immediate attention due to zero-click exploitation potential)
Mitigation if Patching Delayed:
CVSS Score: 9.8 (Critical)
Exploitability Assessment: Exploitation Less Likely
Attack Vector: Network
Privileges Required: None
User Interaction: None
CVE-2026-41089 is a remote code execution vulnerability in Windows Netlogon, the Windows Server process responsible for authentication within Active Directory domains. Despite its critical severity and near-perfect CVSS score, Microsoft has assessed exploitation as "Less Likely."
Technical Details:
The vulnerability exists in how Netlogon processes network requests sent to Windows Servers functioning as domain controllers. An unauthenticated, remote attacker can send a specially crafted network packet that exploits a stack-based buffer overflow vulnerability in the Netlogon service. Successful exploitation allows the attacker to execute arbitrary code on the domain controller with SYSTEM-level privileges.
Impact:
Successful exploitation of a domain controller allows an attacker to:
The potential for complete domain compromise makes this vulnerability extremely dangerous, even though Microsoft assesses exploitation as "Less Likely." The assessment may reflect the complexity of exploitation or specific environmental requirements, but the potential impact justifies treating this as a highest-priority patch.
Exploitation Scenario:
Remediation Priority: Critical (Domain controllers must be patched immediately despite "Less Likely" exploitation assessment)
CVSS Score: 7.8 (High) for all three CVEs
Exploitability Assessment: CVE-2026-33841 and CVE-2026-40369 assessed as "Exploitation More Likely"
Attack Vector: Local
Privileges Required: Low
User Interaction: None
May's release includes three elevation of privilege vulnerabilities affecting the Windows Kernel. These issues allow local attackers with low privileges to escalate to SYSTEM or Medium/High integrity levels, enabling them to bypass security controls and gain administrative access.
Technical Details:
Windows Kernel EoP vulnerabilities typically stem from improper handling of system calls, memory management issues, or insufficient validation of user-supplied data passed to kernel-mode components. Attackers with initial low-privileged access (such as a standard user account or compromised application) can exploit these flaws to execute code with elevated privileges.
Year-to-Date Windows Kernel EoP Context:
Including these three May vulnerabilities, Microsoft has addressed 13 Windows Kernel EoP vulnerabilities so far in 2026. This pattern demonstrates ongoing security challenges in the Windows kernel and highlights why these components remain high-priority targets for attackers.
Impact:
Successful exploitation allows an attacker to:
Exploitation Scenario:
Remediation Priority: High (These vulnerabilities are frequently chained with other exploits in sophisticated attack campaigns)
May 2026 patches affect a comprehensive range of Microsoft products and services:
Windows 10 ESU Reminder: Windows 10 reached end-of-life on October 14, 2025. Organizations still running Windows 10 must maintain active Extended Security Update (ESU) enrollment to receive May patches. Windows 10 Enterprise 2016 LTSB receives extended support until October 13, 2026.
May 12, 2026: 45 days remaining until June 26 Secure Boot certificate expiration
June 9, 2026: Final Patch Tuesday before expiration (17 days remaining)
June 26, 2026: Certificate expiration (ABSOLUTE DEADLINE)
May's Patch Tuesday continues the critical deployment of updated Secure Boot certificates (2023 certificates) required before the June 26, 2026 expiration of original 2011 certificates. With only 45 days remaining, this is the final comfortable deployment window for enterprise-scale infrastructure.
After installing May updates, immediately verify Secure Boot certificate deployment:
PowerShell Validation Method:
# Check Secure Boot state
Confirm-SecureBootUEFI
# Check certificate status (requires administrator privileges)
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -Name UEFICA2023Status
Expected Result: UEFICA2023Status should return "updated" indicating successful certificate deployment.
Alternative Validation: Use Windows Security app in Windows 11/10:
Devices without updated 2023 Secure Boot certificates will experience:
Immediate Effects (June 27, 2026 onwards):
Security Degradation:
Long-term Consequences:
Many devices require manufacturer BIOS/UEFI updates to receive 2023 certificates:
Organizations must coordinate OEM firmware updates alongside Windows Update deployment to ensure complete certificate coverage before June 26.
Adobe released security patches addressing multiple vulnerabilities:
Adobe Acrobat Reader:
Both vulnerabilities affect how Adobe Acrobat Reader processes crafted PDF files, potentially allowing attackers to execute unauthorized actions or compromise user systems through malicious documents. The active exploitation of CVE-2026-34621 makes this an urgent update for organizations where PDF files are routinely opened from external or untrusted sources.
Google released two major Chrome updates addressing over 148 vulnerabilities:
Critical Severity:
High Severity (Active Exploitation):
Additional High Severity (Selected):
The presence of an actively exploited vulnerability (CVE-2026-5281) in Chrome's Dawn component makes this update critical. Microsoft Edge Chromium typically receives these fixes within 3-7 days of Chrome's release.
Mozilla addressed 271 vulnerabilities in Firefox v150, including several high-severity memory corruption and use-after-free bugs:
High Severity:
While no active exploitation has been confirmed, browser vulnerabilities present significant risk due to constant exposure to untrusted web content. Organizations should prioritize browser updates alongside Windows and Office patches.
Oracle's quarterly Critical Patch Update typically addresses:
Organizations running Oracle products should coordinate deployment with Microsoft patches to maintain comprehensive security posture.
SAP's May Security Patch Day addresses critical vulnerabilities:
SAP Business Planning and Consolidation:
This critical vulnerability affects SAP Business Planning and Consolidation and SAP Business Warehouse, allowing attackers to execute arbitrary code. Given the role of these platforms in financial planning and business operations, exploitation could lead to widespread disruption and data compromise.
Week 1 (May 12-18): Assessment and Pilot Deployment
May 12-13 (Days 0-1):
May 14-16 (Days 2-4):
May 17-18 (Days 5-6):
Week 2 (May 19-25): Phase 1 Production Deployment
Week 3 (May 26-June 1): Phase 2 Production Deployment
Week 4 (June 2-8): Phase 3 Production Deployment
Before production deployment, validate:
System Functionality:
Application Compatibility:
Security Validation:
Performance Verification:
Small and Medium Businesses (SMBs):
Enterprise Organizations:
Healthcare, Finance, and Critical Infrastructure:
March 2026 experienced significant update quality problems that inform May deployment strategies:
Support and Recovery Assistant (SaRA) Removed:
Microsoft deprecated SaRA from all currently supported operating systems with March 2026 updates. Organizations using SaRA for Microsoft Office, Microsoft 365, or Outlook troubleshooting should transition to "Get Help," available in both full UI and PowerShell/command-line versions.
May 2026 Patch Tuesday delivers a welcome reprieve from the relentless zero-day activity that characterized Q1 2026, but organizations cannot afford complacency. With 16 critical-severity vulnerabilities requiring immediate attention and only 45 days remaining until the Secure Boot certificate expiration deadline, this release demands aggressive deployment and comprehensive validation.
Critical Action Items:
The Bottom Line:
The absence of actively exploited zero-days provides a critical window for organizations to catch up on deployment and complete Secure Boot certificate validation. However, 16 critical-severity vulnerabilities still require immediate attention, and the June 26 Secure Boot deadline approaches rapidly. Organizations that treat May as routine risk both immediate compromise from the critical vulnerabilities and long-term security degradation when certificates expire.
Time Remaining: 45 Days Until Secure Boot Certificate Expiration
Begin deployment immediately. Verify certificate status across entire infrastructure. Complete OEM firmware updates this month. The June 26 deadline is absolute and non-negotiable.
For automated patch deployment and comprehensive endpoint management, explore Zecurit Endpoint Manager with integrated patch management, vulnerability scanning, and compliance reporting.
