BugRater
Early access: this site has moved to bugrater.com.

Security releases

Microsoft

May 2026 Security Updates

2026-May May 12, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-May
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

210 lines
All 210 CVEs 210 Additional recognition 0 Unclaimed only
Showing 51–100 of 210 · page 2 of 5
CVE-2026-40368 BR2026-0000-002564 unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as Butterfly
CVE-2026-40374 BR2026-0000-002565 unclaimed
Microsoft Power Automate Desktop Information Disclosure Vulnerability
Credited as Ioannis Panagiotopoulos with Microsoft
CVE-2026-40377 BR2026-0000-002566 unclaimed
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Credited as Bruce Dang with Calif.io
CVE-2026-40380 BR2026-0000-002567 unclaimed
Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-40399 BR2026-0000-002568 unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as WARP
CVE-2026-40399 BR2026-0000-002569 unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as MORSE teams at Microsoft
CVE-2026-40405 BR2026-0000-002570 unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Microsoft
CVE-2026-40406 BR2026-0000-002571 unclaimed
Windows TCP/IP Information Disclosure Vulnerability
Credited as Microsoft
CVE-2026-40407 BR2026-0000-002572 unclaimed
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Credited as Microsoft
CVE-2026-40408 BR2026-0000-002573 unclaimed
Windows WAN ARP Driver Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-40414 BR2026-0000-002574 unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Windows Attack Research
CVE-2026-40414 BR2026-0000-002575 unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-40415 BR2026-0000-002576 unclaimed
Windows TCP/IP Remote Code Execution Vulnerability
Credited as Windows Attack Research
CVE-2026-40415 BR2026-0000-002577 unclaimed
Windows TCP/IP Remote Code Execution Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-40417 BR2026-0000-002578 unclaimed
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Credited as Nhien Pham (@nhienit) with Galaxy One
CVE-2026-40419 BR2026-0000-002579 unclaimed
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Credited as 0ccbbf129444eb66344ccafb92b00df4
CVE-2026-40421 BR2026-0000-002580 unclaimed
Microsoft Word Information Disclosure Vulnerability
Credited as tiebuchen
CVE-2026-41088 BR2026-0000-002581 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Soon Oh with Microsoft
CVE-2026-41088 BR2026-0000-002582 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-41089 BR2026-0000-002583 unclaimed
Windows Netlogon Remote Code Execution Vulnerability
Credited as Windows Attack Research
CVE-2026-41089 BR2026-0000-002584 unclaimed
Windows Netlogon Remote Code Execution Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-41094 BR2026-0000-002585 unclaimed
Microsoft Data Formulator Remote Code Execution Vulnerability
Credited as Yoshizawa
CVE-2026-41095 BR2026-0000-002586 unclaimed
Data Deduplication Elevation of Privilege Vulnerability
Credited as ChenJian with Sea Security Orca Team
CVE-2026-41096 BR2026-0000-002587 unclaimed
Windows DNS Client Remote Code Execution Vulnerability
Credited as WARP team at Microsoft
CVE-2026-41101 BR2026-0000-002588 unclaimed
Microsoft Word for Android Spoofing Vulnerability
Credited as Yanir Tsarimi
CVE-2026-41102 BR2026-0000-002589 unclaimed
Microsoft PowerPoint for Android Spoofing Vulnerability
Credited as Yanir Tsarimi
CVE-2026-41109 BR2026-0000-002590 unclaimed
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Credited as Alexander Tan
CVE-2026-41610 BR2026-0000-002591 unclaimed
Visual Studio Code Security Feature Bypass Vulnerability
Credited as Tarek Nakkouch
CVE-2026-41611 BR2026-0000-002592 unclaimed
Visual Studio Code Remote Code Execution Vulnerability
Credited as Microsoft
CVE-2026-41611 BR2026-0000-002593 unclaimed
Visual Studio Code Remote Code Execution Vulnerability
Credited as Tiago Henriques with Coalition inc
CVE-2026-41612 BR2026-0000-002594 unclaimed
Visual Studio Code Information Disclosure Vulnerability
Credited as Aastik Gakhar
CVE-2026-41614 BR2026-0000-002595 unclaimed
M365 Copilot for Desktop Spoofing Vulnerability
Credited as Artem Shymshyrian (Xtytia0922 - V-Spot)
CVE-2026-32161 BR2026-0000-002596 unclaimed
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
Credited as Daniel R
CVE-2026-32185 BR2026-0000-002597 unclaimed
Microsoft Teams Spoofing Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-42831 BR2026-0000-002598 unclaimed
Microsoft Office Remote Code Execution Vulnerability
Credited as pwn2addr
CVE-2026-32175 BR2026-0000-002599 unclaimed
.NET Core Tampering Vulnerability
Credited as Radek Zikmund with Microsoft s.r.o.
CVE-2026-41107 BR2026-0000-002600 unclaimed
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Credited as Adithya Kotian
CVE-2026-41107 BR2026-0000-002601 unclaimed
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-42891 BR2026-0000-002602 unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as xzyhellsing (Saidina Hikam)
CVE-2026-35429 BR2026-0000-002603 unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Alfaz Hossain with POTDF
CVE-2026-35429 BR2026-0000-002604 unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Riski Muhammad Ivan
CVE-2026-35429 BR2026-0000-002605 unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Jody Ritonga with test
CVE-2026-35429 BR2026-0000-002606 unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Rifat Abdul Manaf
CVE-2026-42896 BR2026-0000-002607 unclaimed
Windows DWM Core Library Elevation of Privilege Vulnerability
Credited as namnp with Viettel Cyber Security
CVE-2026-42898 BR2026-0000-002608 unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as John Nzyuko
CVE-2026-42898 BR2026-0000-002609 unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as Kentaro Kawane with GMO Cybersecurity by Ierae, Inc.
CVE-2026-42898 BR2026-0000-002610 unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as hoangha with VCSLab of Viettel Cyber Security
CVE-2026-42898 BR2026-0000-002611 unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as Butterfly
CVE-2026-42899 BR2026-0000-002612 unclaimed
ASP.NET Core Denial of Service Vulnerability
Credited as hamayanhamayan
CVE-2026-42899 BR2026-0000-002613 unclaimed
ASP.NET Core Denial of Service Vulnerability
Credited as Muhammad Abdul Rehman