Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities
- CVEs
- CVE-2026-32161CVE-2026-33109CVE-2026-33844CVE-2026-35421CVE-2026-40358CVE-2026-40361CVE-2026-40363CVE-2026-40364CVE-2026-40365CVE-2026-40366CVE-2026-40367CVE-2026-40403CVE-2026-41089CVE-2026-41096CVE-2026-42831CVE-2026-42898CVE-2026-33835CVE-2026-33837CVE-2026-33840CVE-2026-33841CVE-2026-35416CVE-2026-35417CVE-2026-40369CVE-2026-40397CVE-2026-40398
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-40403 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally | 8.8 group max | <1% | ||
CVE-2026-33109+1 related CVE | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network | 9.9 group max | <1% | ||
CVE-2026-33835+1 related CVE | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally | 7.8 | 2% | ||
CVE-2026-40369+1 related CVE | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally | 7.8 | 5% | PoC ×2 | |
| CVE-2026-33841 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2026-40364 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally | 8.4 group max | 4% | ||
| CVE-2026-40365 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network | 8.8 | <1% | ||
| CVE-2026-41089 | Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089) | 9.8 | 78% | PoC ×6 | |
| CVE-2026-41096 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network | 9.8 | 3% | PoC | |
| CVE-2026-42898 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network | 9.9 | 1% |
From the original article
4 min read at blog.talosintelligence.com
Microsoft has released its monthly security update for May 2026, which includes 137 vulnerabilities affecting a range of products, including 31 that Microsoft marked as “critical”. In this month's release, Microsoft has not observed any of the included vulnerabilities being actively exploited in the wild.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.