Microsoft Patch Tuesday Fixes Record 206 Vulnerabilities
Summary
Microsoft’s latest Patch Tuesday fixed 206 vulnerabilities, its largest monthly batch on record. Three were publicly known but not exploited at release; a separate May 19 update patched an actively exploited Microsoft Defender zero-day.
Key points
- Microsoft patched 206 vulnerabilities in its latest Patch Tuesday release, a record monthly total for the company.
- Three vulnerabilities were publicly known at release but, according to Microsoft, had not been exploited in the wild.
- A separate May 19 out-of-band update patched CVE-2026-41091, an actively exploited zero-day affecting Microsoft Defender.
- The release included one max-severity flaw in Azure HorizonDB and nine critical-rated vulnerabilities.
- Microsoft designated 15 of the vulnerabilities as more likely to be exploited.
- Researchers cited in the article said AI-assisted vulnerability discovery and patch development may contribute to rising patch volumes.
Article Details
- Event Type
- Microsoft Patch Tuesday security update
- Impact
- Microsoft patched 206 vulnerabilities, its largest monthly security patch batch on record. The update addressed an actively exploited zero-day in Microsoft Defender (CVE-2026-41091), three vulnerabilities that were publicly known but not yet exploited in the wild at release (CVE-2026-45586, CVE-2026-50507, and CVE-2026-49160), one max-severity Azure HorizonDB flaw (CVE-2026-48567), and nine critical defects.
CVE
CVE-2026-41091#MicrosoftCVE-2026-45586Microsoft disclosed three vulnerabilities — CVE-2026-45586, CVE-2026-50507 and CVE-2026-49160 — that were publicly known at the time of release, but not yet exploited in the wild, according to the company.CVE-2026-48567#MicrosoftCVE-2026-49160Microsoft disclosed three vulnerabilities — CVE-2026-45586, CVE-2026-50507 and CVE-2026-49160 — that were publicly known at the time of release, but not yet exploited in the wild, according to the company.CVE-2026-50507Microsoft disclosed three vulnerabilities — CVE-2026-45586, CVE-2026-50507 and CVE-2026-49160 — that were publicly known at the time of release, but not yet exploited in the wild, according to the company.
People
Dustin ChildsHead of threat awareness at Trend Micro’s Zero Day Initiative; commented on the unusually large volume of Microsoft patches and its implications.Satnam NarangSenior staff research engineer at Tenable; commented on vulnerability-discovery trends and the potential for high patch volumes to continue.
Vendors
Products
Azure HorizonDBThe update includes publicly known issues, a previously exploited zero-day in Microsoft Defender, and a max-severity flaw in Azure HorizonDB.Microsoft Defender Antimalware PlatformThe update includes publicly known issues, a previously exploited zero-day in Microsoft Defender, and a max-severity flaw in Azure HorizonDB.