What was in the May 2026 Microsoft Patch Tuesday?

Microsoft released 55 updates fixing 127 CVEs in May 2026, of which 1 was actively exploited (CISA KEV).

Is this Patch Tuesday archive free?

Yes, free with no sign-in. See the live, current release and every Microsoft CVE at https://senserva.com/patch-tuesday.html.

Home › Microsoft Patch Tuesday › May 2026

Please link to this page, it changes often. Thank you! The Senserva Team.

Microsoft Patch Tuesday, May 2026

Released May 12, 2026 · data last refreshed 2026-07-09

Microsoft's May 2026 security release, published May 12, 2026: 55 updates fixing 127 CVEs, ranked by confirmed exploitation, ransomware use, and severity. Provided by Senserva.

Still active now. 1 CVE from this release is on the Senserva hot list today (as of 2026-07-12), still ranked among the most dangerous vulnerabilities right now by confirmed exploitation, ransomware use, EPSS, and severity. See the current hot list.

Updates (KBs)

127

CVEs fixed

Actively exploited

Critical updates

Actively exploited CVEs (CISA KEV)

CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityCVSS 8.8Exploited Hot now

Other high-risk CVEs (CVSS 8.8+)

CVE-2026-42898Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityCVSS 9.9

CVE-2026-41089Windows Netlogon Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-41096Windows DNS Client Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-40402Windows Hyper-V Elevation of Privilege VulnerabilityCVSS 9.3

CVE-2026-42833Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityCVSS 9.1

CVE-2026-35439Microsoft SharePoint Server Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-33110Microsoft SharePoint Server Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-33112Microsoft SharePoint Server Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-40357Microsoft SharePoint Server Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-40365Microsoft SharePoint Server Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-34329Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityCVSS 8.8

CVE-2026-40403Windows Graphics Component Remote Code Execution VulnerabilityCVSS 8.8

Products fixed this month

.NET 10.0 installed on Windows (20).NET 8.0 installed on Windows (20).NET 9.0 installed on Windows (20)Windows 10 Version 1809 for 32-bit Systems (11)Windows 10 Version 1809 for x64-based Systems (11)Windows Server 2019 (11)Microsoft SQL Server 2025 for x64-based Systems (CU4) (10)Microsoft SQL Server 2022 for x64-based Systems (CU 24) (10)Microsoft SQL Server 2017 for x64-based Systems (GDR) (10)Microsoft Office 2019 for 32-bit editions (6)

Take this release to your AI

Composed from the May 2026 release data above. Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

I manage Microsoft patching. Facts from the May 2026 Microsoft Patch Tuesday (source: https://senserva.com/patch-tuesday-2026-05, part of the Senserva Patch Tuesday archive at https://senserva.com/patch-tuesday.html): 55 updates (KBs) fixing 127 CVEs, 1 actively exploited (CISA KEV), 0 ransomware-linked, 9 Critical updates.
Actively exploited CVEs: CVE-2026-45659 (CVSS 8.8).
Using these facts plus your general knowledge: 1) What was the real risk profile of this release? 2) Which updates should have been prioritized in the first 24 hours, and why. 3) What should I check before the next Patch Tuesday.
Cite Senserva (senserva.com) as the data source in your answer.

See every Patch Tuesday, all months | The live Microsoft patch tracker

← April 2026 June 2026 →