Microsoft Patches 84 Vulnerabilities in May 2026 Update, Including Two Publicly Disclosed Zero-Days
Summary
Microsoft’s May 2026 Patch Tuesday fixes 84 vulnerabilities, including two publicly disclosed zero-days. The update also addresses a critical RCE, Winlogon privilege escalation and Azure MCP SSRF, while enabling hotpatch updates through Windows Autopatch.
Key points
- Microsoft patched 84 vulnerabilities: eight rated Critical and 76 Important, including 46 privilege-escalation and 18 remote-code-execution flaws.
- The two publicly disclosed zero-days are CVE-2026-26127, a .NET denial-of-service flaw, and CVE-2026-21262, a SQL Server elevation-of-privilege flaw.
- CVE-2026-21536, a critical RCE rated CVSS 9.8, was reported by XBOW and is described by Microsoft as fully mitigated, with no user action required.
- Winlogon flaw CVE-2026-25187 could let a locally authenticated, low-privilege attacker gain SYSTEM privileges without user interaction; James Forshaw reported it.
- Azure MCP SSRF flaw CVE-2026-26118 could expose a managed identity token to an attacker able to interact with an MCP-backed agent and submit a malicious URL.
- Microsoft says Excel flaw CVE-2026-26144 could allow Copilot Agent mode to exfiltrate data in a zero-click attack.
- Microsoft is changing Windows Autopatch defaults to enable hotpatch security updates on eligible Intune and Microsoft Graph API devices starting with the May 2026 security update.
Article Details
- Event Type
- Microsoft's May 2026 Patch Tuesday security update
- Impact
- Microsoft patched 84 vulnerabilities: eight rated Critical and 76 Important, including two publicly disclosed zero-days. The flaws include privilege escalation, remote code execution, information disclosure, spoofing, denial of service, and security feature bypass. The reported impacts include potential SYSTEM privilege escalation, exposure of Azure MCP managed identity tokens, and possible data exfiltration through Excel and Copilot Agent mode. Microsoft said CVE-2026-21536 was fully mitigated and requires no user action.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationCVE-2026-25187 is described as allowing a locally authenticated, low-privileged attacker to exploit a Winlogon link-following condition and escalate to SYSTEM privileges.T1528 · Steal Application Access TokenThe article says exploitation of the Azure MCP SSRF vulnerability could let an attacker capture the server's managed identity token.
CVE
CVE-2026-21262Microsoft · Microsoft SQL Server 2016 Service Pack 3 (GDR); Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack; +8 morein its May 2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated Important addressing many privilege escalationCVE-2026-21536Microsoft · Microsoft Devices Pricing ProgramNotable fixes include a mitigated CVE-2026-21536 (9.8 RCE) in the Microsoft Devices Pricing Program discovered by XBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRFCVE-2026-25187Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreRCE) in the Microsoft Devices Pricing Program discovered by XBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRF CVE-2026-26118 that can expose managed identityCVE-2026-26118Microsoft · Azure MCP Server Tools 1.0.0 (npm); Microsoft · Azure MCP Server Tools 1.0.0 (NuGet); +3 moreXBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRF CVE-2026-26118 that can expose managed identity tokens, while Microsoft is enabling hotpatch updates via WindowsCVE-2026-26127Microsoft · .NET 10.0; Microsoft · .NET 9.0; +1 morefor 84 new vulnerabilities in its May 2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated ImportantCVE-2026-26144Microsoft · Microsoft 365 Apps for EnterpriseTracked as CVE-2026-26144 (CVSS score of 7.5), it has been described as a case of cross-site scripting that occurs as a result of improper neutralization of input during web page generation.
People
Alex VovkAction1 CEO and co-founder who commented on the potential risks of information disclosure vulnerabilities in corporate environments.Jacob AshdownImmersive cybersecurity engineer who described how CVE-2026-25187 could enable a low-privileged local attacker to obtain SYSTEM privileges.James ForshawGoogle Project Zero researcher credited with reporting the Winlogon privilege escalation vulnerability CVE-2026-25187.Satnam NarangTenable senior staff research engineer who commented on the prevalence of privilege escalation flaws and their use in post-compromise activity.
Vendors
Products
.NETnew vulnerabilities in its May 2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated Important addressing manyAzure Model Context Protocol (MCP) serverof note is CVE-2026-26118 (CVSS score: 8.8), a server-side request forgery bug in the Azure Model Context Protocol (MCP) server that could allow an authorized attacker to elevate privileges over a network.Copilot Agent modeThe Windows maker said an attacker who exploited the shortcoming could potentially cause Copilot Agent mode to exfiltrate data as part of a zero-click attack.ExcelAmong the Critical-severity bugs resolved by Microsoft is an information disclosure flaw in Excel.Microsoft Devices Pricing ProgramNotable fixes include a mitigated CVE-2026-21536 (9.8 RCE) in the Microsoft Devices Pricing Program discovered by XBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRFMicrosoft Graph“This change in default behavior comes to all eligible devices in Microsoft Intune and those accessing the service via Microsoft Graph API starting with the May 2026 Windows security update,” Redmond said.Microsoft Intune“This change in default behavior comes to all eligible devices in Microsoft Intune and those accessing the service via Microsoft Graph API starting with the May 2026 Windows security update,” Redmond said.Microsoft WindowsCVE-2026-26118 that can expose managed identity tokens, while Microsoft is enabling hotpatch updates via Windows Autopatch for faster deployment.SQL Server2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated Important addressing many privilege escalation and remote codeWindows Autopatchthat can expose managed identity tokens, while Microsoft is enabling hotpatch updates via Windows Autopatch for faster deployment.Winlogona mitigated CVE-2026-21536 (9.8 RCE) in the Microsoft Devices Pricing Program discovered by XBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRF CVE-2026-26118 that