Microsoft addresses 137 vulnerabilities in May’s Patch Tuesday, including 13 rated critical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33109 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network | 9.9 | <1% | ||
| CVE-2026-41089 | Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089) | 9.8 | 78% | PoC ×6 | |
| CVE-2026-41096 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network | 9.8 | 3% | PoC | |
| CVE-2026-42823 | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network | 9.9 | <1% | ||
| CVE-2026-42898 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network | 9.9 | 1% |
From the original article
3 min read at cyberscoop.com
The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code. Microsoft Romania headquarters in City Gate Towers situated in Free Press Square, in Bucharest, Romania.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.