Microsoft Patches 137 Vulnerabilities in May 2026 Update

Microsoft released security patches on Tuesday for 137 vulnerabilities across its Windows operating systems, Office applications, Azure services, and other products as part of its May 2026 Patch Tuesday update. None of the flaws have been publicly disclosed prior to the release or reported as actively exploited in the wild, marking the first such Patch Tuesday without zero-days in nearly two years.

The update addresses 30 vulnerabilities rated critical, 104 rated important, along with three moderate and one low-severity issue. Among them are 61 privilege escalation bugs, 32 remote code execution flaws, 15 information disclosures, 14 spoofing vulnerabilities, eight denial-of-service issues, six security feature bypasses, and two tampering defects. Microsoft also incorporated a patch for an AMD processor vulnerability, CVE-2025-54518, affecting Zen 2-based products.

Several high-severity flaws drew particular attention from security researchers. CVE-2026-41096, a critical heap-based buffer overflow in the Windows DNS Client with a CVSS score of 9.8, could allow an unauthorized attacker to execute code remotely by sending a specially crafted DNS response. Similarly, CVE-2026-41089,...