Patch Tuesday May 2026: what's exploited and what to install first
Microsoft released fixes for 118 vulnerabilities on May 12, 2026. None are known to be exploited yet. 16 are rated Critical.
118vulnerabilities fixed
0already exploited
0publicly disclosed
16rated Critical
Critical fixes
- CVSS 9.9 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVSS 9.8 Windows Netlogon Remote Code Execution Vulnerability
- CVSS 9.8 Windows DNS Client Remote Code Execution Vulnerability
- CVSS 9.3 Windows Hyper-V Elevation of Privilege Vulnerability
- CVSS 9.1 Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
- CVSS 8.8 Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVSS 8.8 Windows Graphics Component Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Office Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Outlook and Word Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Office Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Word Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Word Remote Code Execution Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 57 |
| Remote Code Execution | 29 |
| Information Disclosure | 9 |
| Denial of Service | 8 |
| Spoofing | 7 |
| Security Feature Bypass | 6 |
| Tampering | 2 |
Most-patched products
| Product | Fixes |
|---|---|
| Windows TCP/IP | 11 |
| Microsoft Office SharePoint | 6 |
| Windows Win32K - GRFX | 6 |
| Microsoft Office Word | 6 |
| Microsoft Office | 6 |
| Windows Ancillary Function Driver for WinSock | 4 |
| Visual Studio Code | 4 |
| .NET | 3 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday May 2026?
Nothing is known to be exploited yet, so follow your normal schedule, starting with the Critical fixes.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's May 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 4, 2026. General information only; confirm details with Microsoft.