Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

Summary: Microsoft released patches for 138 vulnerabilities on Tuesday, none listed as publicly known or under active attack, including 30 rated Critical and 104 rated Important, with 61 privilege escalation and 32 remote code execution flaws among them. The most severe is CVE-2026-41096 (CVSS 9.8), a heap-based buffer overflow in Windows DNS that Microsoft says could let an unauthenticated attacker run code remotely by sending a specially crafted DNS response that the DNS Client misprocesses and corrupts memory.
Bottom line: Microsoft says 16 of this month's fixes came from its AI-driven MDASH scanning system and that AI-assisted discovery will keep expanding Patch Tuesday, with the company already past 500 CVEs five months into the year - so the volume your team must triage is rising faster than the cadence most patch programs were built for.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-54518 CVE-2026-41096 CVE-2026-41103 CVE-2026-42898
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026