Patch Tuesday May 2026: what Microsoft shipped

Microsoft published its security updates on Tuesday, 12 May 2026.

On the day, the briefing reads Microsoft's advisories and this page lists what carried a flag. It stays here afterwards as the record.

Which flaws were flagged?

3 flagged by Microsoft as exploited at release.

3 flagged by Microsoft as publicly disclosed.

4 are in the CISA KEV catalog.

• CVE-2026-41091 Microsoft Defender Elevation of Privilege Vulnerability Exploited at release · Publicly disclosed · In KEV
• CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability Exploited at release · Publicly disclosed · In KEV
• CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability Exploited at release · In KEV
• CVE-2026-45585 Windows BitLocker Security Feature Bypass Vulnerability Publicly disclosed
• CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability In KEV

What PlainSec published

• AI Brand Lures Turn Search Trust Into Credential Theft (2026-06-08)
• Metasploit Makes ActiveMQ RCE Practical (2026-06-06)
• Cloud-Hosted SMTP Relays Turn Into Abuse Service (2026-06-06)
• Trusted Services Become Gamaredon’s Covert Control Path (2026-06-03)
• Game Downloads Became a Persistent Windows Foothold (2026-06-03)
• Port 443 Is No Safe Harbor for This Loader (2026-06-01)
• Session Tokens, Not Passwords, Are the Prize (2026-05-28)
• Tycoon 2FA Keeps Sessions After MFA Falls (2026-05-26)
• Google Ads Turn Claude Downloads Into Malware Lures (2026-05-26)
• Kali365 Expands Beyond Microsoft 365 Tokens (2026-05-23)
• Exchange and Fortinet Footholds Reach Industrial Control Networks (2026-05-23)
• MFA and Password Reset Become the Attack Path (2026-05-19)

What the last cycles held

April 2026: 3 flagged.

March 2026: 2 flagged.

February 2026: 6 flagged.

We hold 12 CVEs from Microsoft's 2026-May document. That is what our records reach, not the size of the release: it grows for weeks after the day.