Microsoft
May 2026 Security Updates
2026-May May 12, 2026 Source: Vendor
Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://msrc.microsoft.com/update-guide/releaseNote/2026-May
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
210 lines
Showing 51–100 of 210 matching · page 2 of 5 · clear filters
CVE-2026-40368
BR2026-0000-002564
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as Butterfly
CVE-2026-40374
BR2026-0000-002565
unclaimed
Microsoft Power Automate Desktop Information Disclosure Vulnerability
Credited as Ioannis Panagiotopoulos with Microsoft
CVE-2026-40377
BR2026-0000-002566
unclaimed
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Credited as Bruce Dang with Calif.io
CVE-2026-40380
BR2026-0000-002567
unclaimed
Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-40399
BR2026-0000-002568
unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as WARP
CVE-2026-40399
BR2026-0000-002569
unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as MORSE teams at Microsoft
CVE-2026-40405
BR2026-0000-002570
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Microsoft
CVE-2026-40406
BR2026-0000-002571
unclaimed
Windows TCP/IP Information Disclosure Vulnerability
Credited as Microsoft
CVE-2026-40407
BR2026-0000-002572
unclaimed
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Credited as Microsoft
CVE-2026-40408
BR2026-0000-002573
unclaimed
Windows WAN ARP Driver Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-40414
BR2026-0000-002574
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Windows Attack Research
CVE-2026-40414
BR2026-0000-002575
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-40415
BR2026-0000-002576
unclaimed
Windows TCP/IP Remote Code Execution Vulnerability
Credited as Windows Attack Research
CVE-2026-40415
BR2026-0000-002577
unclaimed
Windows TCP/IP Remote Code Execution Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-40417
BR2026-0000-002578
unclaimed
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Credited as Nhien Pham (@nhienit) with Galaxy One
CVE-2026-40419
BR2026-0000-002579
unclaimed
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Credited as 0ccbbf129444eb66344ccafb92b00df4
CVE-2026-40421
BR2026-0000-002580
unclaimed
Microsoft Word Information Disclosure Vulnerability
Credited as tiebuchen
CVE-2026-41088
BR2026-0000-002581
unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Soon Oh with Microsoft
CVE-2026-41088
BR2026-0000-002582
unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-41089
BR2026-0000-002583
unclaimed
Windows Netlogon Remote Code Execution Vulnerability
Credited as Windows Attack Research
CVE-2026-41089
BR2026-0000-002584
unclaimed
Windows Netlogon Remote Code Execution Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-41094
BR2026-0000-002585
unclaimed
Microsoft Data Formulator Remote Code Execution Vulnerability
Credited as Yoshizawa
CVE-2026-41095
BR2026-0000-002586
unclaimed
Data Deduplication Elevation of Privilege Vulnerability
Credited as ChenJian with Sea Security Orca Team
CVE-2026-41096
BR2026-0000-002587
unclaimed
Windows DNS Client Remote Code Execution Vulnerability
Credited as WARP team at Microsoft
CVE-2026-41101
BR2026-0000-002588
unclaimed
Microsoft Word for Android Spoofing Vulnerability
Credited as Yanir Tsarimi
CVE-2026-41102
BR2026-0000-002589
unclaimed
Microsoft PowerPoint for Android Spoofing Vulnerability
Credited as Yanir Tsarimi
CVE-2026-41109
BR2026-0000-002590
unclaimed
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Credited as Alexander Tan
CVE-2026-41610
BR2026-0000-002591
unclaimed
Visual Studio Code Security Feature Bypass Vulnerability
Credited as Tarek Nakkouch
CVE-2026-41611
BR2026-0000-002592
unclaimed
Visual Studio Code Remote Code Execution Vulnerability
Credited as Microsoft
CVE-2026-41611
BR2026-0000-002593
unclaimed
Visual Studio Code Remote Code Execution Vulnerability
Credited as Tiago Henriques with Coalition inc
CVE-2026-41612
BR2026-0000-002594
unclaimed
Visual Studio Code Information Disclosure Vulnerability
Credited as Aastik Gakhar
CVE-2026-41614
BR2026-0000-002595
unclaimed
M365 Copilot for Desktop Spoofing Vulnerability
Credited as Artem Shymshyrian (Xtytia0922 - V-Spot)
CVE-2026-32161
BR2026-0000-002596
unclaimed
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
Credited as Daniel R
CVE-2026-32185
BR2026-0000-002597
unclaimed
Microsoft Teams Spoofing Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-42831
BR2026-0000-002598
unclaimed
Microsoft Office Remote Code Execution Vulnerability
Credited as pwn2addr
CVE-2026-32175
BR2026-0000-002599
unclaimed
.NET Core Tampering Vulnerability
Credited as Radek Zikmund with Microsoft s.r.o.
CVE-2026-41107
BR2026-0000-002600
unclaimed
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Credited as Adithya Kotian
CVE-2026-41107
BR2026-0000-002601
unclaimed
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-42891
BR2026-0000-002602
unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as xzyhellsing (Saidina Hikam)
CVE-2026-35429
BR2026-0000-002603
unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Alfaz Hossain with POTDF
CVE-2026-35429
BR2026-0000-002604
unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Riski Muhammad Ivan
CVE-2026-35429
BR2026-0000-002605
unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Jody Ritonga with test
CVE-2026-35429
BR2026-0000-002606
unclaimed
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Credited as Rifat Abdul Manaf
CVE-2026-42896
BR2026-0000-002607
unclaimed
Windows DWM Core Library Elevation of Privilege Vulnerability
Credited as namnp with Viettel Cyber Security
CVE-2026-42898
BR2026-0000-002608
unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as John Nzyuko
CVE-2026-42898
BR2026-0000-002609
unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as Kentaro Kawane with GMO Cybersecurity by Ierae, Inc.
CVE-2026-42898
BR2026-0000-002610
unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as hoangha with VCSLab of Viettel Cyber Security
CVE-2026-42898
BR2026-0000-002611
unclaimed
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Credited as Butterfly
CVE-2026-42899
BR2026-0000-002612
unclaimed
ASP.NET Core Denial of Service Vulnerability
Credited as hamayanhamayan
CVE-2026-42899
BR2026-0000-002613
unclaimed
ASP.NET Core Denial of Service Vulnerability
Credited as Muhammad Abdul Rehman