Microsoft

May 2026 Security Updates

2026-May May 12, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-May

Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

210 lines

Showing 151–200 of 210 · page 4 of 5

CVE-2026-41103 BR2026-0000-002664 unclaimed

Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

Credited as Robert Fitzpatrick with Microsoft

CVE-2026-41613 BR2026-0000-002665 unclaimed

Visual Studio Code Elevation of Privilege Vulnerability

Credited as Elad Luz with Oasis Security

CVE-2026-42823 BR2026-0000-002666 unclaimed

Azure Logic Apps Elevation of Privilege Vulnerability

Credited as Rajesh Chada with Microsoft

CVE-2026-42830 BR2026-0000-002667 unclaimed

Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

Credited as Cristhian Parrot with Kroll

CVE-2026-42832 BR2026-0000-002668 unclaimed

Microsoft Office Spoofing Vulnerability

Credited as Yanir Tsarimi

CVE-2026-42833 BR2026-0000-002669 unclaimed

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Credited as nxhoang99

CVE-2026-42833 BR2026-0000-002670 unclaimed

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Credited as hoangha with VCSLab of Viettel Cyber Security

CVE-2026-42833 BR2026-0000-002671 unclaimed

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Credited as TALHA GÜNAY

CVE-2026-42833 BR2026-0000-002672 unclaimed

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Credited as f7d8c52bec79e42795cf15888b85cbad

CVE-2026-42833 BR2026-0000-002673 unclaimed

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Credited as Kentaro Kawane with GMO Cybersecurity by Ierae, Inc.

CVE-2026-40416 BR2026-0000-002674 unclaimed

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Credited as Jody Ritonga with test

CVE-2026-40416 BR2026-0000-002675 unclaimed

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Credited as Barath Stalin K

CVE-2026-42838 BR2026-0000-002676 unclaimed

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Credited as Spandan Pokhrel

CVE-2026-42893 BR2026-0000-002677 unclaimed

Microsoft Outlook for iOS Tampering Vulnerability

Credited as Ofek Levin with Enclave

CVE-2026-33821 BR2026-0000-002678 unclaimed

Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

Credited as Harun CAN with https://www.linkedin.com/in/mhcan/

CVE-2026-45492 BR2026-0000-002679 unclaimed

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Credited as Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) working with TrendAI Zero Day Initiative

CVE-2026-45494 BR2026-0000-002680 unclaimed

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Credited as Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) working with TrendAI Zero Day Initiative

CVE-2026-45495 BR2026-0000-002681 unclaimed

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Credited as Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) working with TrendAI Zero Day Initiative

CVE-2026-42822 BR2026-0000-002682 unclaimed

Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability

Credited as Sridhar Periyasamy

CVE-2026-45584 BR2026-0000-002683 unclaimed

Microsoft Defender Remote Code Execution Vulnerability

Credited as haowei yan(jingdong dawnslab)

CVE-2026-42834 BR2026-0000-002684 unclaimed

Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability

Credited as BochengXiang(@Crispr) with FDU

CVE-2026-45659 BR2026-0000-002685 unclaimed

Microsoft SharePoint Remote Code Execution Vulnerability

Credited as MEOW

CVE-2026-41091 BR2026-0000-002686 unclaimed

Microsoft Defender Elevation of Privilege Vulnerability

Credited as Damir Moldovanov

CVE-2026-41091 BR2026-0000-002687 unclaimed

Microsoft Defender Elevation of Privilege Vulnerability

Credited as ACD421 with Hollow Point Labs

CVE-2026-41091 BR2026-0000-002688 unclaimed

Microsoft Defender Elevation of Privilege Vulnerability

Credited as Diffract

CVE-2026-41091 BR2026-0000-002689 unclaimed

Microsoft Defender Elevation of Privilege Vulnerability

Credited as Sibusiso with Ironsky

CVE-2026-26129 BR2026-0000-002690 unclaimed

M365 Copilot Information Disclosure Vulnerability

Credited as Estevam Arantes with Microsoft

CVE-2026-33111 BR2026-0000-002691 unclaimed

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Credited as Spandan Pokhrel

CVE-2026-26164 BR2026-0000-002692 unclaimed

M365 Copilot Information Disclosure Vulnerability

Credited as 0xSombra

CVE-2026-26164 BR2026-0000-002693 unclaimed

M365 Copilot Information Disclosure Vulnerability

Credited as Estevam Arantes with Microsoft

CVE-2026-33823 BR2026-0000-002694 unclaimed

Microsoft Team Events Portal Information Disclosure Vulnerability

Credited as Adi Ivascu

CVE-2026-33844 BR2026-0000-002695 unclaimed

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Credited as wtm with Offensi

CVE-2026-34327 BR2026-0000-002696 unclaimed

Microsoft Partner Center Spoofing Vulnerability

Credited as Victor van der Stoep

CVE-2026-35428 BR2026-0000-002697 unclaimed

Azure Cloud Shell Spoofing Vulnerability

Credited as Tomasz Bojarski with https://web-safety.net/

CVE-2026-42826 BR2026-0000-002698 unclaimed

Azure DevOps Information Disclosure Vulnerability

Credited as Noa Royzman with Microsoft

CVE-2026-41104 BR2026-0000-002699 unclaimed

Microsoft Planetary Computer Pro Information Disclosure Vulnerability

Credited as Yanir Tsarimi with Enclave

CVE-2026-42901 BR2026-0000-002700 unclaimed

Microsoft Entra ID Elevation of Privilege Vulnerability

Credited as Thomas Knudson

CVE-2026-42901 BR2026-0000-002701 unclaimed

Microsoft Entra ID Elevation of Privilege Vulnerability

Credited as Sridhar Periyasamy

CVE-2026-23663 BR2026-0000-002702 unclaimed

Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability

Credited as Vamsi Nukavarapu with Microsoft

CVE-2026-23663 BR2026-0000-002703 unclaimed

Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability

Credited as Sriharsha Pallekonda with Microsoft

CVE-2026-41100 BR2026-0000-002704 unclaimed

Microsoft 365 Copilot for Android Spoofing Vulnerability

Credited as Yanir Tsarimi

CVE-2026-21530 BR2026-0000-002705 unclaimed

Windows Rich Text Edit Elevation of Privilege Vulnerability

Credited as Daniel R

CVE-2026-47294 BR2026-0000-002706 unclaimed

Microsoft SharePoint Server Remote Code Execution Vulnerability

Credited as Oleksandr Mirosh

CVE-2026-33841 BR2026-0000-002707 unclaimed