Trending Now - Microsoft's May Patch Tuesday Addresses 120 Vulnerabilities
WHO:
The Register - Tom Gallagher, VP of engineering at Microsoft Security Response Center
The Register - Dustin Childs, Zero Day Initiative bug hunting boss
The Register - Jack Bicer, Action1 vulnerability research director
WHAT:
The Register - Microsoft rated 30 flaws as critical, with 14 earning a CVSS severity rating of 9.0 or higher, including one with a perfect 10.0.
The Register - CVE-2026-33824 is a double-free vulnerability in "ikeext.dll" that could allow an unauthenticated attacker to send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, leading to remote code execution, rated 9.8.
The Hacker News - CVE-2026-33827 is a race condition vulnerability in Windows TCP/IP ("tcpip.sys") that allows an unauthorized attacker to send a specially crafted IPv6 packet to a Windows node where IPSec is enabled, leading to remote code execution exploitation, rated 8.1.
The Register - Microsoft rated a total of 30 flaws as critical, with one vulnerability achieving a perfect 10.0 CVSS severity rating.
The Register - Microsoft’s AI bug hunting system, codenamed MDASH, identified 16 of the vulnerabilities addressed in this month’s release.
BleepingComputer - The May 2026 Patch Tuesday includes 31 remote code execution vulnerabilities, 61 elevation of privilege vulnerabilities, and 14 information disclosure vulnerabilities.
BleepingComputer - CVE-2026-35421 is a Windows GDI remote code execution vulnerability that can be exploited by opening a malicious Enhanced Metafile (EMF) file using Microsoft Paint.
BleepingComputer - CVE-2026-40365 allows an authenticated attacker to perform a network-based attack that remotely executes code on a SharePoint server.
The Register - Microsoft released fixes for 137 CVEs, including 30 rated as critical.
BleepingComputer - The May 2026 Patch Tuesday addresses 120 flaws, with 17 classified as "Critical."
BleepingComputer - 14 of the critical vulnerabilities are remote code execution flaws.
The Register - CVE-2026-41096 is a critical Windows DNS Client remote code execution vulnerability rated 9.8.
The Register - CVE-2026-42898 in Microsoft Dynamics 365 on-premises systems has a CVSS rating of 9.9.
The Register - CVE-2026-41089 is a stack-based buffer overflow in Windows Netlogon rated 9.8.
BleepingComputer - Microsoft fixed numerous vulnerabilities in Microsoft Office, Word, and Excel that could lead to remote code execution.
WHERE:
The Register - The vulnerabilities affect various Microsoft products, including Windows and Microsoft Dynamics 365.
WHEN:
Techmeme - Microsoft will open the MDASH tool to enterprise customers in private preview in June.
BleepingComputer - The May 2026 Patch Tuesday occurred on a Tuesday in May 2026.
WHY:
The Register - Microsoft is using AI to identify more bugs, leading to larger patch releases.
The Register - The vulnerabilities pose risks such as memory corruption, ransomware deployment, and operational disruption.
HOW:
The Hacker News - MDASH is designed to orchestrate more than 100 specialized AI agents to discover, validate, and prove exploitable defects in complex codebases like Windows.
The Register - CVE-2026-41096 can be exploited by sending a specially crafted DNS response to a vulnerable system.
The Register - CVE-2026-42898 can be triggered by an authenticated user modifying the saved state of a process session in Dynamics CRM.
BleepingComputer - Vulnerabilities in Microsoft Office can be exploited by opening malicious files, potentially via the preview pane.
(UPDATED May 13, 2026 23:21 UTC)
Microsoft has identified 30 critical flaws in its software, with 14 of those receiving a severity rating of 9.0 or higher, including one that achieved a perfect score of 10.0. Among these vulnerabilities, CVE-2026-33824 is particularly concerning, as it allows unauthenticated attackers to exploit a double-free vulnerability in "ikeext.dll" for remote code execution, rated at 9.8, while CVE-2026-33827 presents a race condition vulnerability in Windows TCP/IP that could also lead to remote exploitation, rated at 8.1. To address these issues, MDASH has been developed to coordinate over 100 specialized AI agents aimed at discovering and validating exploitable defects in complex codebases like Windows.
--
(UPDATED May 13, 2026 17:43 UTC)
Microsoft has rated a total of 30 flaws as critical in its latest security update, with one vulnerability receiving a perfect 10.0 CVSS severity rating. This month’s Patch Tuesday addresses 31 remote code execution vulnerabilities, 61 elevation of privilege vulnerabilities, and 14 information disclosure vulnerabilities, including a Windows GDI vulnerability that can be exploited through a malicious Enhanced Metafile file in Microsoft Paint. Additionally, Microsoft plans to open its AI bug hunting system, codenamed MDASH, to enterprise customers in private preview starting in June.
--
(UPDATED May 13, 2026 11:46 UTC)
Microsoft has released fixes for 137 CVEs, with 30 of those rated as critical, during the May 2026 Patch Tuesday, which addressed a total of 120 flaws, including 17 classified as critical. Among the critical vulnerabilities are CVE-2026-41096, a Windows DNS Client remote code execution flaw rated 9.8, and CVE-2026-42898 in Microsoft Dynamics 365, which has a CVSS rating of 9.9. These vulnerabilities, affecting various Microsoft products, pose significant risks such as memory corruption and ransomware deployment, and can be exploited through methods like sending crafted DNS responses or opening malicious files.