patch tuesday

Microsoft published CVE-2026-40365 as a Microsoft SharePoint Server remote code execution vulnerability on May 12, 2026, with fixes delivered through SharePoint Server security updates including KB5002870 for SharePoint Server 2019. The important point is not that SharePoint has acquired yet...

Microsoft disclosed CVE-2026-40361, a Microsoft Word remote code execution vulnerability, in its Security Update Guide on May 12, 2026, warning that the bug is serious enough to merit patching even though public technical detail remains limited. That combination — a confirmed vendor advisory, a...

Microsoft published CVE-2026-40358, a Microsoft Office remote code execution vulnerability, in its Security Update Guide for the May 12, 2026 security release, framing the flaw as a credible Office attack path that administrators should treat as patch-now material rather than theoretical noise...

Microsoft disclosed CVE-2026-34339, a Windows Lightweight Directory Access Protocol denial-of-service vulnerability, in its May 12, 2026 Patch Tuesday release, adding it to a 137-CVE Microsoft security batch that also includes Windows TCP/IP, Netlogon, DNS, Hyper-V, Office, Edge, Azure, and...

On May 12, 2026, Microsoft disclosed CVE-2026-34338, an elevation-of-privilege vulnerability in the Windows Telephony Service, through its Security Update Guide as part of the May security update cycle affecting Windows systems that include the legacy telephony component and enterprise...

Microsoft has listed CVE-2026-34337 as a Windows Cloud Files Mini Filter Driver elevation-of-privilege vulnerability in the Security Update Guide, a local Windows flaw whose practical risk depends less on remote reachability than on how quickly attackers can turn sparse public details into...

Microsoft disclosed CVE-2026-33838, a Windows Message Queuing elevation-of-privilege vulnerability, in its Security Update Guide on May 12, 2026, affecting Windows systems where the legacy MSMQ component is present and serviced through the current Windows security update channel. The important...

Microsoft disclosed CVE-2026-33835 on May 12, 2026, as a Windows Cloud Files Mini Filter Driver elevation-of-privilege vulnerability, addressed through the May Patch Tuesday security updates for affected Windows systems and documented in the Microsoft Security Response Center’s Security Update...

Microsoft published CVE-2026-33112 on May 12, 2026, as a Microsoft SharePoint Server remote code execution vulnerability in its Security Update Guide, marking it as a confirmed server-side flaw for administrators to address in the May Patch Tuesday cycle. The dry wording matters because...

Microsoft disclosed CVE-2026-32175, a .NET Core tampering vulnerability, in its Security Update Guide on May 12, 2026, as part of the May Patch Tuesday cycle, identifying the issue as a confirmed flaw in Microsoft’s cross-platform application runtime rather than a speculative third-party report...

Microsoft has listed CVE-2026-42831 as a Microsoft Office remote code execution vulnerability in the Security Update Guide, and the most important public signal on May 12, 2026, is not exploit drama but Microsoft’s confidence that the flaw exists and has enough technical shape to warrant action...

Microsoft disclosed CVE-2026-32170, a Windows Rich Text Edit Control elevation-of-privilege vulnerability, in its May 12, 2026 Security Update Guide as part of the monthly Patch Tuesday release affecting Windows systems that include the Rich Edit component. The important word is not “rich,” and...

Microsoft’s May 12, 2026 Security Update Guide entry identifies CVE-2026-41610 as a Visual Studio Code security feature bypass vulnerability, placing Microsoft’s developer editor back in the patch-management spotlight on Patch Tuesday. The public framing matters because this is not a...

On May 12, 2026, Microsoft released KB5089549 for Windows 11 versions 25H2 and 24H2, raising them to builds 26200.8457 and 26100.8457, while KB5089548 updates Windows 11 version 26H1 to build 28000.2113. The notable part is not that Patch Tuesday arrived; it always does. The notable part is that...

Microsoft disclosed CVE-2026-40415, a Windows TCP/IP remote code execution vulnerability, in its Security Update Guide on May 12, 2026, framing the issue as a network-stack flaw whose risk depends not only on severity but on how confidently defenders can trust the available technical details...

Microsoft disclosed CVE-2026-40408 on May 12, 2026, as an Important-rated Windows WAN ARP Driver elevation-of-privilege vulnerability that affects supported Windows client and server releases and allows a locally authenticated attacker to gain SYSTEM privileges after exploiting a use-after-free...

Microsoft disclosed CVE-2026-40405 on May 12, 2026, as an Important-rated Windows TCP/IP denial-of-service vulnerability caused by a null pointer dereference that lets an unauthenticated attacker deny service over the network on affected Windows 11 and Windows Server 2025 systems. The...

Microsoft published CVE-2026-40399 on May 12, 2026, as an Important-rated Windows TCP/IP elevation-of-privilege vulnerability caused by a stack-based buffer overflow that lets a locally authorized attacker gain SYSTEM privileges after applying pressure to the vulnerable component. The phrase...

Microsoft disclosed CVE-2026-40380 on May 12, 2026, as a Windows Volume Manager Extension Driver remote code execution vulnerability in the Microsoft Security Update Guide, placing a storage-adjacent kernel component into the monthly patching spotlight. The public entry is thin on exploit...

CVE-2026-40360 is a Microsoft Excel information disclosure vulnerability published in Microsoft’s Security Update Guide on May 12, 2026, affecting Excel users who process untrusted workbooks and requiring administrators to evaluate Office updates through the same Patch Tuesday machinery used for...