For the first time in almost two years, Microsoft’s monthly Patch Tuesday update arrived without a single zero-day vulnerability among its fixes — a milestone that has quietly stunned the security community. The May 2026 Patch Tuesday addresses 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 applications, yet not one of those flaws was being actively exploited in the wild or publicly disclosed prior to the patch release.
The last time Microsoft shipped a Patch Tuesday without an emergency zero-day fix was June 2024. Since then, every monthly update has included at least one race-against-time scramble to plug a hole attackers were already using. May 2026’s clean slate is a welcome, if cautious, reason for IT teams to breathe — but the sheer breadth of what is being patched means no one should lower their guard.
The Scope: 120 Vulnerabilities, 17 Critical
Microsoft’s engineers closed 120 security holes this month, spanning a familiar roster of products: Windows operating systems, Microsoft Office, Dynamics 365, SharePoint Server, Azure cloud services, and the .NET runtime. Seventeen of those vulnerabilities carry the most serious “Critical” rating, meaning an attacker can exploit them remotely with little or no help from the victim.
Breaking down the categories: 61 of the vulnerabilities are elevation-of-privilege bugs — the kind that let a low-level intruder silently promote themselves to SYSTEM or administrator level. Remote code execution flaws account for 31 entries. The remaining count is split among information disclosure (14), spoofing (13), denial-of-service (8), and security-feature bypass (6) issues. By volume alone, this is one of the heavier months of 2026.
The Headlines: Netlogon and DNS Client
Two vulnerabilities in particular deserve immediate attention from enterprise administrators.
CVE-2026-41089 — Windows Netlogon (CVSS 9.8): This critical stack-based buffer overflow sits inside the Windows Netlogon service, the authentication backbone that domain controllers rely on to verify identities across a network. Exploitation requires no privileges and no interaction from a logged-in user. A successful attack grants the adversary SYSTEM-level access on the domain controller itself — effectively handing over the keys to the entire Windows domain. Security researchers have drawn comparisons to the infamous Zerologon and SigRed vulnerabilities, both of which sent enterprises scrambling years ago. CVE-2026-41089 has not been exploited yet, but given that domain controllers are the crown jewels of enterprise networks, expect proof-of-concept code to circulate quickly now that the patch details are public.
CVE-2026-41096 — Windows DNS Client (CVSS 9.8): A heap-based buffer overflow in the Windows DNS Client opens another unauthenticated remote code execution path. An attacker running a malicious DNS server — or positioned to intercept DNS traffic — can send a crafted DNS response that triggers the overflow and executes arbitrary code on the victim machine. Because virtually every Windows device queries DNS constantly, the attack surface is enormous. Network segmentation and DNS filtering become critical backstops while patching rolls out.
Office and Word: Four RCEs Worth Watching
Microsoft patched four separate remote code execution vulnerabilities in Microsoft Word this month, all exploitable through the age-old “open a malicious document” attack vector. Despite years of sandboxing improvements, malicious Office files remain one of the most reliable delivery mechanisms for enterprise intrusions. The four Word RCEs are rated Important rather than Critical — meaning Microsoft believes exploitation is less straightforward — but that assessment has historically not stopped sophisticated actors.
Additional Office-family fixes cover Microsoft Excel, Outlook, and the broader Microsoft 365 productivity suite. Organizations that have not yet deployed Protected View policies or disabled macros by default should treat this month as a final warning.
SharePoint and Dynamics 365: Internet-Facing Risk
Two products that deserve top-of-queue patching are SharePoint Server and Microsoft Dynamics 365 on-premises. Both are frequently exposed to the internet, and both received critical or high-severity patches this month.
SharePoint is a perennial Patch Tuesday fixture, but its continued prominence as a collaboration platform — especially in regulated industries — makes any unpatched SharePoint instance a liability. Dynamics 365 on-premises deployments, often running in mid-market and manufacturing environments, sometimes lag behind on patching cycles due to upgrade complexity. This month’s fixes underscore why that lag is dangerous.
Windows GDI, Wi-Fi, and Win32k
Three additional vulnerability classes are worth flagging for desktop and mobile device teams.
The Windows Graphics Device Interface (GDI) received fixes for flaws that can be triggered by opening a malicious Enhanced Metafile (EMF) image in Microsoft Paint or any application that renders EMF content. Windows Win32k — the kernel-level graphics subsystem — patched elevation-of-privilege flaws that have historically been favorites of APT groups for post-exploitation privilege escalation.
The Windows Native Wi-Fi Miniport driver also received patches, which is notable for environments with a large fleet of laptops connecting to untrusted wireless networks. A malicious access point or a rogue actor on the same Wi-Fi segment could potentially exploit this flaw before a user even opens a browser.
The Broader Context: AI and Accelerating Patch Velocity
May’s Patch Tuesday does not exist in isolation. Earlier in 2026, Oracle announced it was shifting to a monthly patch cadence for critical security issues, following years of pressure from enterprise customers frustrated by quarterly update cycles. Adobe’s own May 2026 security release addressed 52 vulnerabilities across Premiere Pro, Illustrator, After Effects, and Commerce — 27 of them rated Critical.
The common thread across all three vendors is the accelerating role of AI in vulnerability discovery. Security researchers and, increasingly, AI-assisted scanning tools are finding bugs faster than ever. Vendors are responding with higher patch volumes and shorter cycles. For security teams, this creates a grinding operational tempo: evaluate, test, deploy, repeat — every month, without exception.
What IT Teams Should Do Right Now
The absence of zero-days does not mean this update can slide into next week’s queue. The Netlogon and DNS Client vulnerabilities in particular have all the hallmarks of flaws that will attract rapid exploitation once researchers publish their analyses.
Prioritization guidance for May 2026:
1. Domain controllers first: Patch CVE-2026-41089 immediately. Anything that can hand SYSTEM access on a DC to an unauthenticated attacker is a five-alarm fire waiting to happen.
2. DNS Client on all Windows devices: CVE-2026-41096 affects any Windows machine making DNS queries — which is all of them. Roll this out broadly and quickly.
3. Internet-facing services next: SharePoint Server and Dynamics 365 on-premises should follow immediately after DC and DNS patching.
4. Office and Word last but not delayed: User-facing phishing risks from the four Word RCEs are real. Ensure endpoint protection is up to date as a compensating control while patches deploy.
A Word of Cautious Optimism
The zero-day drought is meaningful, even if it may not last. It suggests that Microsoft’s investments in secure-by-design engineering, expanded bug bounty programs, and proactive internal security reviews are beginning to show measurable results at the monthly update level. Whether that trend holds through the summer remains to be seen.
For now, IT administrators can appreciate the moment — and then get back to patching.
