cve.bz

Microsoft Patch Tuesday, May 2026: the CVEs

Filter

Microsoft Patch Tuesday May 2026: the CVEs Microsoft published on 12 May 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 9.9CVE-2026-42898EPSS 1.2%

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

  2. 9.1CVE-2026-42833EPSS 0.7%

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

  3. 9.9CVE-2026-42823EPSS 0.6%

    Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

  4. 9.1CVE-2026-41103EPSS 5.4%

    Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

  5. 9.8CVE-2026-41096EPSS 2.7%

    Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

  6. 9.8CVE-2026-41089EPSS 78%

    Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

  7. 9.3CVE-2026-40402EPSS 0.3%

    Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.

  8. 9.9CVE-2026-33821EPSS 0.7%

    Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

  9. 9.1CVE-2026-33117EPSS 0.5%

    The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable loca…