InfoSecBulletin Cybersecurity for mankind
Microsoft’s May 2026 Patch Tuesday brings many updates for businesses. It fixes 120 security flaws in Windows, Office, Azure, developer tools, and Microsoft 365 apps. Among these, 29 critical flaws let attackers run code from far away.
Microsoft says there are no zero-days used in attacks or announced before this release, which is different from past cycles. However, the wide range of areas that could be attacked, like DNS, Netlogon, Office, and Wi-Fi drivers, means that those defending systems should not see this month as low risk.
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
| Vulnerability Type | Count |
|---|---|
| Elevation of Privilege | 61 |
| Security Feature Bypass | 6 |
| Remote Code Execution (RCE) | 31 |
| Information Disclosure | 14 |
| Denial of Service (DoS) | 8 |
| Spoofing | 13 |
Multiple Remote Code Execution Vulnerabilities
This month has no zero-day bugs being used, but the biggest flaws are with network and document-related RCE vulnerabilities that could lead to total control if not fixed.
High‑value targets include Microsoft Dynamics 365 on‑premises (CVE‑2026‑42898, CVE‑2026‑42833), multiple Microsoft Office and Word RCEs (for example CVE‑2026‑42831, CVE‑2026‑40363, CVE‑2026‑40358, several Word‑specific CVEs), Windows DNS Client (CVE‑2026‑41096), Netlogon (CVE‑2026‑41089), Windows Graphics/Win32k (CVE‑2026‑40403), Windows GDI (CVE‑2026‑35421), Windows Native Wi‑Fi Miniport (CVE‑2026‑32161), and Microsoft SharePoint Server (CVE‑2026‑40365 and related CVEs).
Many of these are in parts that often face untrusted content, network traffic, Office documents, or web-like processes. This makes them likely targets for phishing and other attacks.
Windows Core Networking, Kernel, and Virtualization Flaws
Many flaws affect Windows networking and kernel parts, increasing risks for systems connected to domains and the internet.
Windows DNS Client RCE (CVE‑2026‑41096) and Netlogon RCE (CVE‑2026‑41089) are important issues: attackers with low access or no access could run code in critical areas of Windows authentication and name resolution. This is similar to the effects of past bugs like SigRed and Zerologon.
Windows Hyper-V (CVE-2026-40402, rated Critical) gets a fix for privilege escalation. This is very important for shared and private cloud systems. A guest could escape to host and cause big problems.
Copilot, VS Code, and Azure Flaws
This Patch Tuesday shows how much AI and cloud-based development are part of business security risks.
Microsoft fixes problems with fake identities and security gaps in M365 Copilot for Desktop and Android, GitHub Copilot with Visual Studio, and Azure Machine Learning notebooks. These issues raise worries about tricking users, stealing data, or adding harmful content through trusted AI tools.
Organizations that have a lot of virtual work should plan times for Hyper-V updates. Those using Copilot, Teams, and Azure should not forget about fixes for AI and workflows, even if they are marked as Important.
