Microsoft Patch Tuesday May 2026: Fixing 120 vulnerabilities

Microsoft has released its regular Patch Tuesday for May 2026 , moving forward with an extensive set of security updates that address a total of 120 vulnerabilities in products and services in the Windows ecosystem. Although this release does not include any known zero-day exploits , the number and severity of issues being fixed is causing intense interest in the cybersecurity community.

17 critical vulnerabilities require immediate attention

Of the total number of bugs fixed, 17 are classified as “Critical.” 14 are related to remote code execution (RCE), two are related to elevation of privilege , and one is related to disclosure of sensitive information.

Remote code execution remains one of the most dangerous attack categories, as it allows an attacker to execute malicious software on a computer without physical access. In corporate environments, such vulnerabilities can lead to network compromise, data theft, and ransomware installation.

See also: APT28 linked to MSHTML zero-day ahead of February Patch Tuesday

Detailed categories of vulnerabilities

Microsoft listed the fixes in the following categories:

• 61 elevation of privilege vulnerabilities
• 31 remote code execution vulnerabilities
• 14 information disclosure vulnerabilities
• 13 spoofing vulnerabilities
• 8 Denial of Service vulnerabilities
• 6 security bypass vulnerabilities

Privilege escalation vulnerabilities continue to dominate numerically, demonstrating that cybercriminals are still targeting techniques that allow for the acquisition of elevated privileges within a system after the initial breach.

Several Microsoft fixes are off the list

It's worth noting that the 120 vulnerability count refers exclusively to the updates released by Microsoft as part of Patch Tuesday. It does not include fixes that were already released earlier in the month for platforms such as Mariner, Azure, Copilot, Microsoft Teams, and Microsoft Partner Center.

See also: Microsoft fixes 167 vulnerabilities in latest Patch Tuesday

At the same time, 131 Microsoft Edge vulnerabilities related to the Chromium engine and fixed by Google remain outside the official list . This element reveals how complex the modern software ecosystem has become, where different vendors indirectly cooperate for the overall security of users .

Microsoft Office targeted by attacks

Of particular interest are the fixes for Microsoft Office, Word, and Excel. Microsoft confirmed the existence of multiple vulnerabilities that could lead to remote code execution via malicious files.

Attacks are typically based on forged documents sent via email or file-sharing applications. By opening the file, the attacker can gain access to the victim's system or install malware without being immediately noticed.

Also of concern is the fact that several of these vulnerabilities can even be triggered through the file preview window. This means that in some cases the full document opening is not even required for the attack to begin.

For this reason, security experts recommend installing the updates, especially in organizations that handle a large volume of emails and attachments daily.

The most dangerous vulnerabilities of the month

Among the most important fixes is CVE-2026-35421, a critical vulnerability in Windows GDI that can be exploited via malicious Enhanced Metafile (EMF) files. Opening such a file in Microsoft Paint could allow arbitrary code to be executed on the user's system.

See also: Microsoft Patch Tuesday February 2026: Fixes for 58 vulnerabilities

Also receiving particular attention is CVE-2026-40365, which affects Microsoft SharePoint Server. According to Microsoft, an authenticated user could exploit the vulnerability over a network and remotely execute malicious code on the server. For businesses that rely on SharePoint for collaboration and document management, this vulnerability is considered high risk.

Equally serious is CVE-2026-41096 , which affects the Windows DNS Client. A malicious DNS server could send specially crafted responses to vulnerable systems, causing memory corruption and ultimately remote code execution.

Cybersecurity is now becoming a daily necessity

The May 2026 Patch Tuesday confirms that cyber threats are constantly evolving and impacting both individual users and large organizations. Regular installation of security updates is no longer an optional process, but a key part of digital defense .

As attacks become increasingly targeted and sophisticated, timely software updates and proper user training remain the most important factors in protecting against modern cyberthreats.

Microsoft Patch Tuesday May 2026: All vulnerabilities

In the table below, you can see all the vulnerabilities being fixed this month:

Source: www.bleepingcomputer.com