Microsoft
May 2026 Security Updates
2026-May May 12, 2026 Source: Vendor
Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://msrc.microsoft.com/update-guide/releaseNote/2026-May
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
210 lines
Showing 101–150 of 210 · page 3 of 5
CVE-2026-41615
BR2026-0000-002614
unclaimed
Microsoft Authenticator Information Disclosure Vulnerability
Credited as Sridhar Periyasamy
CVE-2026-33110
BR2026-0000-002615
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as f7d8c52bec79e42795cf15888b85cbad
CVE-2026-33112
BR2026-0000-002616
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as khoadha
CVE-2026-33112
BR2026-0000-002617
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as Rafael Resende
CVE-2026-33833
BR2026-0000-002618
unclaimed
Azure Machine Learning Notebook Spoofing Vulnerability
Credited as Jianyang Song
CVE-2026-33835
BR2026-0000-002619
unclaimed
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Credited as Joe Desimone with Elastic Security
CVE-2026-33837
BR2026-0000-002620
unclaimed
Windows TCP/IP Local Elevation of Privilege Vulnerability
Credited as h4urek with secsys lab
CVE-2026-33838
BR2026-0000-002621
unclaimed
Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-34332
BR2026-0000-002622
unclaimed
Windows Kernel-Mode Driver Remote Code Execution Vulnerability
Credited as Microsoft Offensive Research
CVE-2026-34332
BR2026-0000-002623
unclaimed
Windows Kernel-Mode Driver Remote Code Execution Vulnerability
Credited as Security Engineering
CVE-2026-34334
BR2026-0000-002624
unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-34336
BR2026-0000-002625
unclaimed
Windows DWM Core Library Elevation of Privilege Vulnerability
Credited as Sergey immortalp0ny Tarasov with Positive Technologies
CVE-2026-34337
BR2026-0000-002626
unclaimed
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Credited as Microsoft
CVE-2026-34338
BR2026-0000-002627
unclaimed
Windows Telephony Service Elevation of Privilege Vulnerability
Credited as DongJun Kim with Enki WhiteHat
CVE-2026-34339
BR2026-0000-002628
unclaimed
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Credited as Aniq Fakhrul
CVE-2026-34339
BR2026-0000-002629
unclaimed
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Credited as Howard McGreehan with MSRC V&M
CVE-2026-34340
BR2026-0000-002630
unclaimed
Windows Projected File System Elevation of Privilege Vulnerability
Credited as ChenJian with Sea Security Orca Team
CVE-2026-34341
BR2026-0000-002631
unclaimed
Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-40357
BR2026-0000-002632
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as Oleksandr Mirosh
CVE-2026-40359
BR2026-0000-002633
unclaimed
Microsoft Excel Remote Code Execution Vulnerability
Credited as f4
CVE-2026-40359
BR2026-0000-002634
unclaimed
Microsoft Excel Remote Code Execution Vulnerability
Credited as Zhiniang Peng with HUST
CVE-2026-40361
BR2026-0000-002635
unclaimed
Microsoft Outlook and Word Remote Code Execution Vulnerability
Credited as Haifei Li with EXPMON
CVE-2026-40362
BR2026-0000-002636
unclaimed
Microsoft Excel Remote Code Execution Vulnerability
Credited as Haein Lee with KAIST Hacking Lab
CVE-2026-40362
BR2026-0000-002637
unclaimed
Microsoft Excel Remote Code Execution Vulnerability
Credited as Jeongmin Choi with S2W
CVE-2026-40365
BR2026-0000-002638
unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as f7d8c52bec79e42795cf15888b85cbad
CVE-2026-40367
BR2026-0000-002639
unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as 0ccbbf129444eb66344ccafb92b00df4
CVE-2026-40370
BR2026-0000-002640
unclaimed
SQL Server Remote Code Execution Vulnerability
Credited as Piotr Bazydło (@chudypb)
CVE-2026-40369
BR2026-0000-002641
unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Théo DUTEIS
CVE-2026-40369
BR2026-0000-002642
unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-40369
BR2026-0000-002643
unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Adrian Denkiewicz at Doyensec in collaboration with Anthropic Research
CVE-2026-40369
BR2026-0000-002644
unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Len Sadowski (lytnc)
CVE-2026-40369
BR2026-0000-002645
unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Oguz Bektas (_ozb_)
CVE-2026-40382
BR2026-0000-002646
unclaimed
Windows Telephony Service Elevation of Privilege Vulnerability
Credited as DongJun Kim with Enki WhiteHat
CVE-2026-40397
BR2026-0000-002647
unclaimed
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Credited as Puneeth Kumar Katikela
CVE-2026-40397
BR2026-0000-002648
unclaimed
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Credited as Microsoft
CVE-2026-32209
BR2026-0000-002649
unclaimed
Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability
Credited as Adam Hassan with Microsoft Offensive Research
CVE-2026-32209
BR2026-0000-002650
unclaimed
Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability
Credited as Security Engineering (MORSE)
CVE-2026-40398
BR2026-0000-002651
unclaimed
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-40401
BR2026-0000-002652
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Windows Attack Research
CVE-2026-40401
BR2026-0000-002653
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Protection (WARP) with Microsoft
CVE-2026-40402
BR2026-0000-002654
unclaimed
Windows Hyper-V Elevation of Privilege Vulnerability
Credited as Ashutosh with skyhighsecurity
CVE-2026-40403
BR2026-0000-002655
unclaimed
Windows Graphics Component Remote Code Execution Vulnerability
Credited as Calif.io
CVE-2026-40403
BR2026-0000-002656
unclaimed
Windows Graphics Component Remote Code Execution Vulnerability
Credited as Milad Nasr (Anthropic) with Claude with Calif.io and Anthropic
CVE-2026-40413
BR2026-0000-002657
unclaimed
Windows TCP/IP Denial of Service Vulnerability
Credited as Microsoft
CVE-2026-40418
BR2026-0000-002658
unclaimed
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Credited as 0ccbbf129444eb66344ccafb92b00df4
CVE-2026-35436
BR2026-0000-002659
unclaimed
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Credited as Ben Lichtman with Microsoft
CVE-2026-40420
BR2026-0000-002660
unclaimed
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Credited as Ben Lichtman with Microsoft
CVE-2026-41097
BR2026-0000-002661
unclaimed
Secure Boot Security Feature Bypass Vulnerability
Credited as Microsoft
CVE-2026-40381
BR2026-0000-002662
unclaimed
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Credited as Eli Arshin with Microsoft
CVE-2026-40381
BR2026-0000-002663
unclaimed
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Credited as Michal Kamensky with Microsoft