Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Summary: Microsoft's May 2026 security update covers 137 vulnerabilities, 31 of them rated critical, and Microsoft reports none of them were observed being actively exploited in the wild. Sixteen of the critical entries are remote code execution flaws across products including Office, Word, Azure, SharePoint, Windows Netlogon, Windows DNS Client, and the Windows Native WiFi Miniport Driver, with named issues such as CVE-2026-41089 (Netlogon stack buffer overflow exploitable by an unauthenticated attacker against a domain controller) and CVE-2026-35421 (Windows GDI heap overflow triggered when a user opens a crafted EMF file in Microsoft Paint).
What you should know: CVE-2026-41089 lets an attacker send a crafted request to a domain controller and run code without signing in or having prior access, and CVE-2026-41096 does the same to the Windows DNS Client through a single crafted DNS response - both reachable over the network with no credentials required.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-32161 CVE-2026-33109 CVE-2026-33844 CVE-2026-35421 CVE-2026-40358 CVE-2026-40361 CVE-2026-40363 CVE-2026-40364 CVE-2026-40365 CVE-2026-40366 CVE-2026-40367 CVE-2026-40403 CVE-2026-41089 CVE-2026-41096
Related: Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws Cyber Risks ·
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026