The Numbers Behind Microsoft’s Largest 2026 Patch Cycle
Microsoft’s May 2026 Patch Tuesday addressed 120 vulnerabilities across its product portfolio — its largest single patch release of 2026 to date. The breakdown reveals where attackers are most likely to focus.
By vulnerability type:
- 61 Elevation of Privilege (EoP)
- 31 Remote Code Execution (RCE)
- 14 Information Disclosure
- 13 Spoofing
- 8 Denial of Service
- 6 Security Feature Bypass
By severity:
- 17 Critical (14 RCE, 2 EoP, 1 Information Disclosure)
- 103 Important
The 61 EoP vulnerabilities are the most operationally significant metric in this release. EoP flaws are often overlooked in patching prioritization because they require an attacker to already have a foothold on the system — but in an environment where initial access is frequently achieved via phishing or credential theft, an EoP vulnerability is what converts a low-privilege beachhead into domain administrator access. In May 2026, Microsoft patched 61 such pathways.
The absence of actively exploited zero-days is welcome, but it does not mean the risk is low. Threat actors routinely reverse-engineer patches within 24-72 hours of Patch Tuesday and develop exploits for “newly patched” vulnerabilities before most enterprises have applied the fix. The 14 Critical RCE vulnerabilities in this release are exactly the class of finding that gets weaponized in this window.
Five CVEs That Should Drive Your Patching Priority
Not all 120 CVEs are equal. The following five represent the highest operational risk based on attack surface, exploitability, and the consequences of successful exploitation.
1. CVE-2026-41096 — Windows DNS Client RCE (Critical, Network-Adjacent)
An attacker-controlled DNS server can send a specially crafted DNS response to a vulnerable Windows system, causing the DNS Client to incorrectly process the response and corrupt memory, enabling remote code execution. This is a network-adjacent RCE — meaning it does not require the attacker to be on the same subnet but does require routing the victim through a malicious DNS server, achievable via DNS poisoning or by controlling an upstream resolver. Every Windows system that resolves external DNS names is potentially in scope. Apply immediately; prioritize domain controllers and systems that query external resolvers directly.
2. CVE-2026-35421 — Windows GDI RCE via Enhanced Metafile (Critical, User-Interaction)
Exploitation requires opening a malicious Enhanced Metafile (EMF) file in Microsoft Paint — or any application that renders EMF content. The practical attack surface is significant: EMF files can be embedded in Word documents, sent as email attachments, or delivered via SharePoint links. Given that Microsoft Paint is installed on all Windows systems and EMF is a standard image format, the exploitation path requires only social engineering. This CVE should be patched in the same priority tier as the DNS client RCE.
3. CVE-2026-40365 — SharePoint Server RCE (Critical, Authenticated Network)
Authenticated attackers with network access to a vulnerable SharePoint Server instance can achieve remote code execution. SharePoint Server is a common enterprise collaboration platform — and “authenticated” does not require high privilege; a standard SharePoint user account is sufficient for exploitation. Organizations running on-premises SharePoint Server (as opposed to SharePoint Online) must apply this patch. Microsoft 365 customers with SharePoint Online are not affected — this is an on-premises vulnerability.
4. Ivanti EPMM CVE-2026-6973 — Actively Exploited Zero-Day (External)
While not part of the Microsoft patch cycle, Ivanti’s actively exploited zero-day CVE-2026-6973 in Endpoint Manager Mobile (versions 12.8.0.0 and prior) warrants co-scheduling with May Patch Tuesday work. Documented targets include the European Commission, the Dutch Data Protection Authority, and Finland’s Valtori government ICT service center. The U.S. CISA mandated federal remediation within three days of disclosure. Organizations running Ivanti EPMM should treat this as a P0 emergency patch — the fixed versions are 12.6.1.1, 12.7.0.1, and 12.8.0.1.
5. Office Preview-Pane RCE Cluster (Critical — Multiple CVEs)
Microsoft patched multiple RCE vulnerabilities in Office applications — Word and Excel — that trigger in the preview pane without requiring the user to open the file. Preview-pane exploits are particularly dangerous because they require only that the email or document appears in the preview window, removing the social engineering step of convincing a user to double-click. Organizations should verify that their email security gateway is stripping or sandboxing all Office attachments before delivery, not relying on the endpoint patch alone for this class of vulnerability.
Advertisement
What Enterprise Security Teams Should Do This Patch Cycle
1. Run a Risk-Based Triage — Do Not Apply All 120 Patches Equally
The 120-CVE volume makes uniform priority patching impractical. Use the following triage model: Critical RCEs with no user interaction required (DNS client, SharePoint) → Critical RCEs with user interaction (GDI, Office preview pane) → Critical EoP vulnerabilities on domain controllers → all remaining Important-rated vulnerabilities. Allocate dedicated emergency windows for the first tier rather than folding them into the next quarterly maintenance window.
2. Audit On-Premises SharePoint Deployments Immediately
CVE-2026-40365 affects SharePoint Server — an on-premises product that many organizations retain alongside Microsoft 365 for legacy document management or compliance reasons. The attack surface is any authenticated user, and the consequence is server-side RCE. Run an inventory of all SharePoint Server instances in your environment this week. If any are internet-facing, apply the patch or take the service offline within 24 hours of this reading. Per eSecurity Planet’s May 2026 security roundup, authenticated RCE on collaboration platforms is consistently among the highest-exploited CVE classes in enterprise environments.
3. Segment DNS Resolution and Monitor for DNS Client Anomalies
The Windows DNS Client RCE (CVE-2026-41096) is exploitable via a malicious DNS server sending a crafted response. The most effective interim mitigation while patching is being staged is to restrict which DNS servers Windows clients are permitted to query — enforce DNS resolution through controlled internal resolvers only, and block outbound DNS (UDP/TCP 53) from workstations to any destination other than the designated corporate resolver. Enable DNS query logging across all environments to detect any systems that have been configured or manipulated to query external resolvers directly.
4. Apply Patch Verification Checks at the Business-Unit Level
In large environments, Patch Tuesday patches are often applied at the infrastructure level but fail silently on endpoints that are offline, have storage constraints, or have misconfigured Windows Update settings. A patch that is not verifiably applied is not a patch. Schedule automated compliance checks 72 hours after deployment that confirm the specific KB numbers corresponding to the Critical CVEs have been installed, and escalate any non-compliant endpoint for manual remediation before the next patch cycle.
The Structural Challenge: Patch Velocity vs. Operational Continuity
The May 2026 Patch Tuesday exposes a structural tension in enterprise security programs: patching velocity versus operational continuity. With 120 vulnerabilities — 17 Critical — security teams face pressure to apply patches immediately, while operations teams need adequate testing windows to avoid introducing regressions into production systems.
The 24-72 hour weaponization window for newly disclosed CVEs is real and well-documented. SecurityWeek’s analysis of major breach attribution repeatedly shows that unpatched critical vulnerabilities — not zero-days — are the root cause of most major enterprise breaches. The correlation is clear: organizations that cannot patch Critical CVEs within 14 days of disclosure carry materially higher breach risk than those with 7-day critical patch SLAs.
The solution is not to patch everything at once — it is to have a tiered SLA model: Critical no-interaction RCEs → 24-48 hours emergency window; Critical user-interaction RCEs → 72-hour window; Critical EoP → 7 days; Important-rated → 30 days. This model preserves operational continuity for the bulk of patches while creating a defensible posture for the highest-risk CVEs that get weaponized in days, not weeks.
Frequently Asked Questions
Why does the absence of zero-days in May 2026 Patch Tuesday not mean the risk is low?
Threat actors regularly reverse-engineer Microsoft patches within 24-72 hours of Patch Tuesday to develop exploits targeting the newly fixed vulnerabilities. This means a Critical RCE that had no public exploit at release time can become actively weaponized within days. The 14 Critical RCE vulnerabilities in the May 2026 release represent the exact class of finding that attackers race to exploit before most organizations have completed patching. “No active zero-day at disclosure” does not mean “safe to delay patching.”
Who is affected by the SharePoint Server RCE (CVE-2026-40365)?
Only organizations running on-premises SharePoint Server are affected — Microsoft 365 customers using SharePoint Online are not at risk. The vulnerability requires an authenticated SharePoint user account, which means any standard employee with SharePoint access could be exploited to achieve server-side remote code execution. Organizations retaining on-premises SharePoint for legacy compliance or document management should apply the patch or take the server offline immediately.
What is the practical risk of the Windows GDI Enhanced Metafile vulnerability?
CVE-2026-35421 allows exploitation when a malicious EMF file is opened in Microsoft Paint or any application rendering EMF content. The practical attack path is embedding a malicious EMF in an email attachment, a Word document, or a SharePoint download link. Users do not need to run an executable — simply opening a document containing a malicious EMF is sufficient. Email security gateways should be configured to scan and quarantine all EMF-embedded documents, and Windows Paint should be restricted to known-good content sources where possible.
—
Sources & Further Reading
- Microsoft May 2026 Patch Tuesday Fixes 120 Flaws — BleepingComputer
- Ivanti EPMM Zero-Day CVE-2026-6973 — Help Net Security
- Supply Chain Attacks and Major Breaches Define May 2026 — eSecurity Planet
- Dozens of Major Breaches Linked to Single Threat Actor — SecurityWeek
- Google Chrome Security Update — Infosecurity Magazine
🔗 Related Intelligence
AI-Assisted Vulnerability Management: From Scan to Patch in Hours, Not Weeks
SBOM: From Compliance Checkbox to Active Security Tool in 2026
Six Zero-Days Under Active Attack: Inside February 2026’s Most Dangerous Patch Tuesday
March 2026 Zero-Day Harvest: Chrome, Android, and SQL Server Under Fire
