# Microsoft May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days, and a Troubling Acceleration


## The Threat


For the first time in nearly two years, Microsoft's monthly Patch Tuesday update contained no actively exploited zero-day vulnerabilities—a rare reprieve in an increasingly hostile threat landscape. However, the absence of zero-days should not be mistaken for calm. The May 2026 update addressed 137 confirmed vulnerabilities, including nine rated as critical and 13 flagged as likely exploitation targets by threat actors. This marks the third consecutive month in 2026 where Microsoft has disclosed more than 100 CVEs in a single update cycle.


Among the critical flaws are two remote code execution vulnerabilities in Microsoft Office Word that leverage the Preview Pane as an attack vector. CVE-2026-40361 and CVE-2026-40364, both carrying CVSS scores of 8.4, allow unauthenticated attackers to execute arbitrary code on vulnerable systems. Additionally, CVE-2026-40464—a type-confusion vulnerability also resulting in remote code execution—poses significant risk to enterprises where Office is ubiquitous. Five additional vulnerabilities carry near-maximum severity scores of 9.8 or 9.9, indicating widespread exposure and minimal barriers to exploitation.


Through May alone, Microsoft has patched over 500 CVEs, putting the company on pace to exceed 2020's annual record of 1,245 disclosed bugs. This acceleration is driven partly by AI-assisted vulnerability discovery, which Microsoft leadership expects will push patch volumes even higher in coming months.


## Severity and Impact


| Metric | Details |

|--------|---------|

| CVEs Patched (May 2026) | 137 total |

| Critical Vulnerabilities | 9 |

| Likely Exploitation Candidates | 13 |

| Highest CVSS Scores | 9.8–9.9 (5 vulnerabilities) |

| Key Vulnerabilities | CVE-2026-40361 (Office Word, CVSS 8.4); CVE-2026-40364 (Office Word, CVSS 8.4); CVE-2026-40464 (RCE via type-confusion, CVSS 8.4) |

| Attack Vector (Word CVEs) | Preview Pane remote code execution |

| YTD CVE Count (through May 2026) | 500+ |

| Pace vs. 2020 Record | 1,245 annual bugs (2020) — 2026 already at 500 in 5 months |


## Affected Products


  • Microsoft Office Suite: Word (critical Preview Pane vulnerabilities)
  • Microsoft Windows: Multiple versions affected by critical remote code execution flaws
  • Microsoft Exchange Server: Remote code execution vulnerabilities
  • Microsoft SharePoint: Elevation of privilege and remote code execution bugs
  • Microsoft Dynamics 365: Multiple privilege escalation flaws
  • Microsoft Edge: Critical browser vulnerabilities
  • Azure: Cloud platform privilege escalation and information disclosure bugs

    • ## Mitigations


    Immediate Actions:

  • Prioritize deployment of critical updates (CVSS 9.0+) across all Microsoft products within 48 hours
  • Disable Preview Pane in Microsoft Office as a temporary mitigation for Word vulnerabilities (CVE-2026-40361, CVE-2026-40364) until patches are applied
  • Restrict Preview Pane functionality via Group Policy in enterprise environments

    • Short-Term Measures:

  • Implement network segmentation to isolate systems running older Office versions that cannot be immediately patched
  • Enable Enhanced Mitigation Experience Toolkit (EMET) on high-value systems
  • Deploy Application Guard for Office documents in enterprise environments to sandbox potentially malicious content
  • Monitor for exploit attempts using endpoint detection and response (EDR) tools, focusing on Office and Exchange processes

    • Long-Term Remediation:

  • Establish a formal patching SLA that requires critical vulnerabilities to be deployed within 72 hours of release
  • Inventory all Windows and Office deployments to identify systems requiring patching
  • Consider enabling automatic patching for non-legacy systems where operational requirements allow
  • Review and test patch deployment across development, staging, and production environments before broad rollout

    • Network Defense:

  • Block potentially malicious Office file extensions at email gateways if not required for business operations
  • Monitor outbound connections from Office processes to detect compromised systems
  • Implement email filtering rules to quarantine Office files from untrusted sources during high-risk periods

    • ## References


  • Microsoft Security Update Guide: [May 2026 Security Updates](https://msrc.microsoft.com/)
  • Original reporting: Dark Reading, "It's Patch Tuesday for Microsoft & Not a Zero-Day In Sight"
  • Tenable Research: CVE Disclosure Trends 2026
  • Microsoft Engineering Blog: Tom Gallagher's statement on AI-driven vulnerability discovery

    • ---


    ## HackWire Analysis


    The absence of zero-days in Microsoft's May 2026 update might seem like welcome news, but the underlying story is more sobering: vulnerability discovery is accelerating at a pace that outstrips patch management capabilities in most organizations. Microsoft has already disclosed more vulnerabilities in the first five months of 2026 than were released annually for much of the 2010s. At this trajectory, the company will shatter its previous record set in 2020.


    The culprit, according to Microsoft leadership, is AI. Advanced AI models are now parsing code paths and configurations at speeds and consistency human reviewers simply cannot match. This is genuinely a good development for security—buried vulnerabilities are better found and patched than left for threat actors to discover. But it creates an operational crisis: organizations are drowning in patches.


    The real risk isn't the individual CVEs; it's the adoption lag. With 137 patches to evaluate, test, and deploy each month, many enterprises will inevitably fall behind. Patch Tuesdays are becoming less a monthly rhythm and more a sustained operational crisis. The two Office Word vulnerabilities leveraging Preview Pane as an attack vector are particularly insidious because they don't require user action beyond previewing a file—a feature most end users trust implicitly.


    Defenders should treat this trend as a forcing function to modernize their patch management infrastructure. Manual testing workflows cannot scale to this volume. Organizations that have not yet implemented automated patch testing, staged rollout systems, and continuous monitoring for exploit attempts are operating on borrowed time. The zero-day reprieve is not a sign of stability—it's a moment to catch your breath before the next wave hits.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)