Threats

May 2026 Patch Tuesday: 30 Critical Vulnerabilities Among 130 CVEs

Microsoft's May 2026 Patch Tuesday release addresses 130 security vulnerabilities across its product portfolio, with 30 rated critical — an unusually high proportion that underscores a heavy patching month for security teams. The update covers Windows, Microsoft Office, Azure cloud services, SharePoint Server, Exchange, and Microsoft Defender components. Among the most significant fixes are the SharePoint RCE vulnerability CVE-2026-45659 (CVSS 8.8), multiple Defender vulnerabilities being actively exploited in the wild, and critical Azure service flaws. Security teams should prioritize patching internet-facing systems and any products with known-active exploitation. The volume of critical fixes this month will strain patch management programs that must balance deployment speed against operational risk of introducing new issues.

View on Graph

Overview

  • Microsoft’s May 2026 Patch Tuesday release addresses 130 security vulnerabilities across its product portfolio, with 30 rated critical — an unusually high proportion that underscores a heavy patching month for security teams.
  • The update covers Windows, Microsoft Office, Azure cloud services, SharePoint Server, Exchange, and Microsoft Defender components.
  • Among the most significant fixes are the SharePoint RCE vulnerability CVE-2026-45659 (CVSS 8.8), multiple Defender vulnerabilities being actively exploited in the wild, and critical Azure service flaws.
  • Security teams should prioritize patching internet-facing systems and any products with known-active exploitation.
  • The volume of critical fixes this month will strain patch management programs that must balance deployment speed against operational risk of introducing new issues.

Sources