Microsoft's security release of 12 May 2026
Patch Tuesday, May 2026
As of , CISA lists none of the 125 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2026-40369, Windows Kernel Elevation of Privilege.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 125 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 124 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 9 CVEs |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-40369Windows Kernel Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.00 |
| 2 | CVE-2026-33110Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 3 | CVE-2026-33112Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 4 | CVE-2026-35439Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 5 | CVE-2026-40357Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 6 | CVE-2026-40368Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.02 |
| 7 | CVE-2026-42899ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 8 | CVE-2026-41097Secure Boot Security Feature Bypass | None | Not on CISA's list | 6.7 Medium | 0.02 |
| 9 | CVE-2026-42823Azure Logic Apps Elevation of Privilege | None | Not on CISA's list | 9.9 Critical | 0.01 |
| 10 | CVE-2026-42898Microsoft Dynamics 365 On-Premises Remote Code Execution | None | Not on CISA's list | 9.9 Critical | 0.01 |
| 11 | CVE-2026-41089Windows Netlogon Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 12 | CVE-2026-41096Windows DNS Client Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 13 | CVE-2026-40379Azure Entra ID Spoofing | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 14 | CVE-2026-41103Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege | None | Not on CISA's list | 9.1 Critical | 0.01 |
| 15 | CVE-2026-42833Microsoft Dynamics 365 On-Premises Remote Code Execution | None | Not on CISA's list | 9.1 Critical | 0.01 |
| 16 | CVE-2026-34329Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2026-40365Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2026-40370SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2026-41086Windows Admin Center in Azure Portal Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2026-41094Microsoft Data Formulator Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 21 | CVE-2026-41109GitHub Copilot and Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 22 | CVE-2026-41613Visual Studio Code Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2026-35438Windows Admin Center Elevation of Privilege | None | Not on CISA's list | 8.3 High | 0.01 |
| 24 | CVE-2026-33833Azure Machine Learning Notebook Spoofing | None | Not on CISA's list | 8.2 High | 0.01 |
| 25 | CVE-2026-40415Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 26 | CVE-2026-34332Windows Kernel-Mode Driver Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 27 | CVE-2026-41611Visual Studio Code Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2026-33821Microsoft Dynamics 365 Customer Insights Elevation of Privilege | None | Not on CISA's list | 7.7 High | 0.01 |
| 29 | CVE-2026-35424Internet Key Exchange (IKE) Protocol Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 30 | CVE-2026-40405Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 31 | CVE-2026-40406Windows TCP/IP Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 32 | CVE-2026-40413Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.4 High | 0.01 |
| 33 | CVE-2026-40414Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.4 High | 0.01 |
| 34 | CVE-2026-41107Microsoft Edge (Chromium-based) Information Disclosure | None | Not on CISA's list | 7.4 High | 0.01 |
| 35 | CVE-2026-42893Microsoft Outlook for iOS Tampering | None | Not on CISA's list | 7.4 High | 0.01 |
| 36 | CVE-2026-32177.NET Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 37 | CVE-2026-35433.NET Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 38 | CVE-2026-34350Windows Storport Miniport Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 39 | CVE-2026-35422Windows TCP/IP Driver Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 40 | CVE-2026-40374Microsoft Power Automate Desktop Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 41 | CVE-2026-42830Azure Monitor Agent Metrics Extension Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 42 | CVE-2026-41610Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 43 | CVE-2026-32185Microsoft Teams Spoofing | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 44 | CVE-2026-35440Microsoft Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 45 | CVE-2026-41612Visual Studio Code Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 46 | CVE-2026-35423Windows 11 Telnet Client Information Disclosure | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 47 | CVE-2026-32175.NET Core Tampering | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 48 | CVE-2026-35429Microsoft Edge (Chromium-based) for Android Spoofing | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 49 | CVE-2026-40421Microsoft Word Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 50 | CVE-2026-40402Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 9.3 Critical | 0.00 |
| 51 | CVE-2026-33117Azure SDK for Java Security Feature Bypass | None | Not on CISA's list | 9.1 Critical | 0.00 |
| 52 | CVE-2026-35436Microsoft Office Click-To-Run Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 53 | CVE-2026-40403Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.00 |
| 54 | CVE-2026-40420Microsoft Office Click-To-Run Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 55 | CVE-2026-40358Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 56 | CVE-2026-40361Microsoft Outlook and Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 57 | CVE-2026-40363Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 58 | CVE-2026-40364Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 59 | CVE-2026-40366Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 60 | CVE-2026-40367Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 61 | CVE-2026-32204Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 62 | CVE-2026-33834Windows Event Logging Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 63 | CVE-2026-33835Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 64 | CVE-2026-33837Windows TCP/IP Local Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 65 | CVE-2026-33838Windows Message Queuing (MSMQ) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 66 | CVE-2026-33840Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 67 | CVE-2026-33841Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 68 | CVE-2026-34330Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 69 | CVE-2026-34333Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 70 | CVE-2026-34334Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 71 | CVE-2026-34336Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 72 | CVE-2026-34337Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 73 | CVE-2026-34338Windows Telephony Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 74 | CVE-2026-34343Windows Application Identity (AppID) Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 75 | CVE-2026-34344Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 76 | CVE-2026-34351Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 77 | CVE-2026-35415Windows Storage Spaces Controller Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 78 | CVE-2026-35417Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 79 | CVE-2026-35418Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 80 | CVE-2026-35420Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 81 | CVE-2026-35421Windows GDI Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 82 | CVE-2026-40359Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 83 | CVE-2026-40360Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.8 High | 0.00 |
| 84 | CVE-2026-40362Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 85 | CVE-2026-40377Microsoft Cryptographic Services Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 86 | CVE-2026-40381Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2026-40382Windows Telephony Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2026-40397Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2026-40398Windows Remote Desktop Services Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2026-40399Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2026-40407Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 92 | CVE-2026-40408Windows WAN ARP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 93 | CVE-2026-40417Microsoft Dynamics 365 Business Central Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 94 | CVE-2026-40418Microsoft Office Click-To-Run Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 95 | CVE-2026-40419Microsoft Office Click-To-Run Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 96 | CVE-2026-41088Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 97 | CVE-2026-41095Data Deduplication Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 98 | CVE-2026-42831Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 99 | CVE-2026-42896Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 100 | CVE-2026-42832Microsoft Office Spoofing | None | Not on CISA's list | 7.7 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 12 May 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.