May 2026 Patch Tuesday forecast: AI starts driving security industry changes
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown). Do: Patch by installing the kernel update for CVE-2026-31431 through your distribution's security channel (Red Hat Enterprise Linux including AUS/EUS/TUS/SAP channels, OpenShift, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Arista/Siemens firmware/software as applicable) and reboot into the patched kernel; the data provides no fixed version numbers, so defer to vendor advisories. Because the flaw is in CISA's KEV catalog (added 2026-05-01) with a 99.9% EPSS score, prioritize internet-reachable and multi-user systems first and follow BOD 22-01 guidance for cloud services. Check running kernel versions ('uname -r') and distribution advisory status to confirm you are on a fixed build. | 7.8 | 100% | KEV PoC ×5 |
| masshundreds of millions to billions of installations (servers, cloud instances, desktops, and Android/embedded devices running affected kernel generations) | |
| CVE-2026-33825 | Local Privilege Escalation in Microsoft Defender Antimalware Platform CVE-2026-33825 is an insufficient granularity of access control flaw (CWE-1220) in Microsoft Defender Antimalware Platform that allows an authorized attacker to elevate privileges locally. It is triggered by an attacker who already holds a low-privileged foothold on a machine running Defender, with no user interaction required. Successful exploitation has high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8), granting elevated local rights that facilitate defense evasion, persistence, or ransomware activity. Any organization running Microsoft Defender on Windows endpoints and servers is potentially affected. The flaw is actively exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-22 with ransomware use confirmed, and is one of three Microsoft Defender zero-days reported as exploited, two of which were still unpatched at the time of reporting. Do: Apply Microsoft's April 2026 Patch Tuesday updates for the Defender Antimalware Platform (platform/security intelligence updates) per vendor instructions, consistent with CISA BOD 22-01 timelines for KEV entries, and note reports that two of the three exploited Defender zero-days were still unpatched, so monitor for follow-up fixes. Prioritize patching internet-reachable and high-value Windows hosts, and hunt for signs of local privilege escalation and ransomware precursor activity on systems that cannot be updated immediately. | 7.8 | 7% | KEV ransomware |
| masshundreds of millions of Windows endpoints and servers (Defender is the default antimalware on Windows) | |
| CVE-2026-40372 | Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 9.1 | 11% |
| — |
Full article1,011 words · extracted from helpnetsecurity.com · click to collapse
Microsoft May 2026 Patch Tuesday is now live: Many fixes, but no zero-days
Project Glasswing. This is one of three major security industry changes I’ll cover today. The Anthropic Mythos vulnerability discovery model has already proven to be game changing in its ability to identify new vulnerabilities in software. Many of these vulnerabilities have existed for 10 to 15 years without human discovery. In a recent announcement from Mozilla, they discovered 271 vulnerabilities when running it against Firefox 150 prior to release. This sheer volume of new vulnerabilities is driving change.
NIST moves to threat-based CVE analysis
In an unprecedented agreement known as Project Glasswing, 12 companies agreed to work with Anthropic on a preview version of this new technology. These include Apple, Amazon, Cisco, Microsoft, and others who would normally be competing for this technology. The goal is to finally get ahead of the zero-day releases and minimize the risk from attacks. In another major shift, NIST announced it was changing its vulnerability analysis efforts to a risk or threat-based approach.
All CVEs will continue to be added to the National Vulnerability Database (NVD), but it would prioritize its ‘enrichment’ process on those vulnerabilities known to be exploited or associated with software used in the federal government or software identified as critical. Per the announcement they enriched over 42,000 CVEs in 2025 and cannot keep that pace with all CVEs now being reported. And finally, my third change, the increase in frequency of patch releases to keep up with this flood of vulnerabilities.
A prime example here is the announcement from Oracle that their Critical Patch Updates (CPUs) would be expanded from quarterly to monthly releases, with previously skipped months to now include additional security updates as needed. As AI ramps up, many aspects of patch management will continue to change and evolve in response.
OOB updates fix critical ASP.NET core vulnerability
Microsoft provided two important out-of-band (OOB) patches this month. The first was soon after the April Patch Tuesdays updates and impacted all the currently supported server versions from 2016 through 2025. The April security update KB5082063 was failing on Windows Server 2025 in many reported cases and any server version which was acting as a domain controller could possibly go into a restart loop with their respective April updates.
On April 19th, Microsoft issued a series of OOB patches to address these issues. Two days later on April 21st, Microsoft issued an OOB update for .NET 10.0.7. This resolved CVE-2026-40372, an Escalation of Privilege vulnerability with a CVSS of 9.1 and rated Critical. This vulnerability was found in the ASP.NET core data protection cryptographic APIs and could allow a user to gain System privilege. Both of these OOB fixes will be rolled into the next Patch Tuesday update.
Microsoft simplifies Windows Insider Program
Microsoft announced a major change to their Windows Insider Program this month. Per the explanation in the blog, the feedback they were getting from community members was that the channel structure and the feature delivery were confusing. With that in mind, they simplified it to two channels, Experimental and Beta. The Experimental channel is just that, cutting edge features in development which may or may not make a release. They welcome feedback but there is no guarantee they may even make a release.
The Beta channel is what you would expect by the name, these releases contain features in near final form which will be included in the next release. Feedback here will help fine tune them for general use. You will be able to move between the channels more easily without having to make completely new installs of your base OS. Community members can expect to be migrated to the appropriate new channels soon.
CopyFail exposes Linux systems to privilege escalation
There are a few hot vulnerabilities getting some extended press that you need to be aware of going into next week’s Patch Tuesday. The first is CVE-2026-33825 which is associated with the Bluehammer exploit. This exploit had a zero-day fix for Microsoft Defender in the April Patch Tuesday release, but since then two additional exploits from the same attacker called RedSun and UnDefend have yet to be addressed. Keep an eye out for a fix this month.
And finally, Linux vulnerability CVE-2026-31431, also called CopyFail, is an AI-discovered elevation of privilege vulnerability, which has been present since 2017. A simple proof of concept (PoC) exploit allowed a standard user to obtain root privileges. Patches for the major Linux distributions were released within a week near the beginning of April, so make sure you are updated and protected against attacks targeting this critical vulnerability.
May 2026 Patch Tuesday forecast
- Microsoft is part of Project Glasswing, so we could see a new record number of CVEs reported. Based on this new ability to identify issues, expect security updates across the entire Microsoft portfolio next week.
- The Adobe rotation for Creative Cloud Apps updates will most likely contain Audition, Animate, Premier Pro, and perhaps some repeats from last month like Acrobat depending on which vulnerabilities have surfaced.
- Apple, also a founding member of Project Glasswing, is due for their next set of OS and application security updates. They may be released on or near Patch Tuesday just to ‘ride the wave’ of updates so be on the lookout. Anticipate a large number of new CVEs discovered as part of this project as well.
- Google Chrome 149 will be released next week; most likely on Patch Tuesday.
- Mozilla released Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2 on Thursday, May 7. Expect corresponding Thunderbird and Thunderbird ESR updates soon. Mozilla was releasing security updates once a month, but that has accelerated to once a week for the past several weeks. We’ll need to see if that trend continues.
And so it begins. We’re certainly starting to see the impact AI has on the security industry. The recent breakthrough of Anthropic’s Mythos is sure to be the first of many tools which will reshape how we approach code development and conduct patch management operations.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/05/08/may-2026-patch-tuesday-forecast/