Microsoft Patches 137 Vulnerabilities in May Patch Tuesday, Reports No Actively Exploited Zero-Days

Summary

Microsoft addressed 137 vulnerabilities, including 13 rated critical, and reported no actively exploited zero-days. Researchers highlighted potential unauthenticated remote code execution in Windows DNS and Netlogon, plus a critical Dynamics 365 flaw.

Key points

• Microsoft patched 137 vulnerabilities across its products; 13 were rated critical.
• Microsoft reported no actively exploited zero-days in this Patch Tuesday release.
• The company designated 13 vulnerabilities as more likely to be exploited and 113 as less likely or unlikely.
• Trend Micro ZDI's Dustin Childs said CVE-2026-41096 in Windows DNS could allow unauthenticated remote code execution.
• Childs described Windows Netlogon flaw CVE-2026-41089 as high impact and requiring immediate patching.
• CVE-2026-42898 in Dynamics 365 was rated critical; Action1's Jack Bicer warned that basic access could enable remote execution.

CVE

People

Vendors

Products

Related Articles

• BeyondTrust Report: Critical Microsoft Vulnerabilities Doubled in 2025github.com/jacobdjwilsonAzure · Microsoft Dynamics 365 · Microsoft Windows · Microsoft
• Microsoft patches 1,094 vulnerabilities in November 2026 updatecyberscoop.comAzure · Microsoft Windows · Microsoft
• Infoblox Tracks Three Actors Reusing Expired Malicious Domainsinfoblox.comAzure · Microsoft Windows · Microsoft
• Acronis Analyzes Qilin Ransomware’s Windows and ESXi Capabilitiesacronis.comAzure · Microsoft Windows · Microsoft
• Microsoft Fixes Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Daysecurityweek.comAzure · Microsoft Windows · Microsoft