Threat intelligence
Microsoft Security Bulletin Coverage for May 2026
Overview
Microsoft’s May 2026 Patch Tuesday has 132 vulnerabilities, of which 61 are elevation of privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of May 2026 and has produced coverage for 13 reported vulnerabilities.
Vulnerabilities with Detections
CVE | CVE Title | Signature |
| CVE-2026-33835 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | ASPY 7218 Exploit-exe exe.MP_521 |
| CVE-2026-33837 | Windows TCP/IP Local Elevation of Privilege Vulnerability | ASPY 7219 Exploit-exe exe.MP_522 |
| CVE-2026-33840 | Win32k Elevation of Privilege Vulnerability | ASPY 7220 Exploit-exe exe.MP_523 |
| CVE-2026-33841 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 7221 Exploit-exe exe.MP_524 |
| CVE-2026-35416 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ASPY 7222 Exploit-exe exe.MP_525 |
| CVE-2026-35417 | Windows Win32k Elevation of Privilege Vulnerability | ASPY 682 Exploit-exe exe.MP_519 |
| CVE-2026-40361 | Microsoft Word Remote Code Execution Vulnerability | ASPY 681 Malformed-rtf rtf.MP_42 |
| CVE-2026-40364 | Microsoft Word Remote Code Execution Vulnerability | ASPY 684 Malformed-rtf rtf.MP_43 |
| CVE-2026-40369 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 680 Exploit-exe exe.MP_518 |
| CVE-2026-40397 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ASPY 683 Exploit-exe exe.MP_520 |
| CVE-2026-40398 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | ASPY 679 Exploit-exe exe.MP_517 |
| CVE-2026-41089 | Windows Netlogon Remote Code Execution Vulnerability | IPS 22165 Windows Netlogon Remote Code Execution (CVE-2026-41089) |
| CVE-2026-41103 | Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability | IPS 22164 Microsoft SSO Plugin for Jira & Confluence EoP (CVE-2026-41103) |
Release Breakdown
The vulnerabilities can be classified into the following categories:
For May there are 31 critical and 101 important vulnerabilities.
Microsoft tracks vulnerabilities that are being actively exploited at the time of discovery and those that have been disclosed publicly before the patch Tuesday release for each month. The above chart displays these metrics as seen each month.
Release Detailed Breakdown
Denial of Service Vulnerabilities
| CVE | CVE Title |
| CVE-2026-34339 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability |
| CVE-2026-34350 | Windows Storport Miniport Driver Denial of Service Vulnerability |
| CVE-2026-35424 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability |
| CVE-2026-40401 | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40405 | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40413 | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-40414 | Windows TCP/IP Denial of Service Vulnerability |
| CVE-2026-42899 | ASP.NET Core Denial of Service Vulnerability |
Elevation of Privilege Vulnerabilities
| CVE | CVE Title |
| CVE-2026-21530 | Windows Rich Text Edit Elevation of Privilege Vulnerability |
| CVE-2026-32170 | Windows Rich Text Edit Elevation of Privilege Vulnerability |
| CVE-2026-32177 | .NET Elevation of Privilege Vulnerability |
| CVE-2026-32185 | Microsoft Teams Spoofing Vulnerability |
| CVE-2026-32204 | Azure Monitor Agent Elevation of Privilege Vulnerability |
| CVE-2026-33821 | Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability |
| CVE-2026-33834 | Windows Event Logging Service Elevation of Privilege Vulnerability |
| CVE-2026-33835 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
| CVE-2026-33837 | Windows TCP/IP Local Elevation of Privilege Vulnerability |
| CVE-2026-33838 | Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
| CVE-2026-33839 | Win32k Elevation of Privilege Vulnerability |
| CVE-2026-33840 | Win32k Elevation of Privilege Vulnerability |
| CVE-2026-33841 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-34330 | Win32k Elevation of Privilege Vulnerability |
| CVE-2026-34331 | Win32k Elevation of Privilege Vulnerability |
| CVE-2026-34333 | Windows Win32k Elevation of Privilege Vulnerability |
| CVE-2026-34334 | Windows TCP/IP Elevation of Privilege Vulnerability |
| CVE-2026-34337 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
| CVE-2026-34338 | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-34340 | Windows Projected File System Elevation of Privilege Vulnerability |
| CVE-2026-34341 | Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability |
| CVE-2026-34342 | Windows Print Spooler Elevation of Privilege Vulnerability |
| CVE-2026-34343 | Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability |
| CVE-2026-34344 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-34345 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-34347 | Windows Win32k Elevation of Privilege Vulnerability |
| CVE-2026-34351 | Windows TCP/IP Elevation of Privilege Vulnerability |
| CVE-2026-35415 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability |
| CVE-2026-35416 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-35417 | Windows Win32k Elevation of Privilege Vulnerability |
| CVE-2026-35418 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
| CVE-2026-35420 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-35433 | .NET Elevation of Privilege Vulnerability |
| CVE-2026-35435 | Azure AI Foundry Elevation of Privilege Vulnerability |
| CVE-2026-35436 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-35438 | Windows Admin Center Elevation of Privilege Vulnerability |
| CVE-2026-40369 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-40377 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
| CVE-2026-40381 | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
| CVE-2026-40382 | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-40397 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2026-40398 | Windows Remote Desktop Services Elevation of Privilege Vulnerability |
| CVE-2026-40399 | Windows TCP/IP Elevation of Privilege Vulnerability |
| CVE-2026-40402 | Windows Hyper-V Elevation of Privilege Vulnerability |
| CVE-2026-40407 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2026-40408 | Windows WAN ARP Driver Elevation of Privilege Vulnerability |
| CVE-2026-40410 | Windows SMB Client Elevation of Privilege Vulnerability |
| CVE-2026-40417 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
| CVE-2026-40418 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40419 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40420 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-41086 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability |
| CVE-2026-41088 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-41095 | Windows Projected File System Elevation of Privilege Vulnerability |
| CVE-2026-41103 | Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability |
| CVE-2026-41105 | Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability |
| CVE-2026-41613 | Visual Studio Code Elevation of Privilege Vulnerability |
| CVE-2026-42823 | Azure Logic Apps Elevation of Privilege Vulnerability |
| CVE-2026-42825 | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-42830 | Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability |
| CVE-2026-42896 | Windows DWM Core Library Elevation of Privilege Vulnerability |
Information Disclosure Vulnerabilities
| CVE | CVE Title |
| CVE-2026-26129 | M365 Copilot Information Disclosure Vulnerability |
| CVE-2026-26164 | M365 Copilot Information Disclosure Vulnerability |
| CVE-2026-33111 | Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability |
| CVE-2026-33823 | Microsoft Team Events Portal Information Disclosure Vulnerability |
| CVE-2026-34336 | Windows DWM Core Library Information Disclosure Vulnerability |
| CVE-2026-35419 | Windows DWM Core Library Information Disclosure Vulnerability |
| CVE-2026-35423 | Windows 11 Telnet Client Information Disclosure Vulnerability |
| CVE-2026-35440 | Microsoft Word Information Disclosure Vulnerability |
| CVE-2026-40360 | Microsoft Excel Information Disclosure Vulnerability |
| CVE-2026-40374 | Microsoft Power Automate Desktop Information Disclosure Vulnerability |
| CVE-2026-40406 | Windows TCP/IP Information Disclosure Vulnerability |
| CVE-2026-40421 | Microsoft Word Information Disclosure Vulnerability |
| CVE-2026-41612 | Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-42826 | Azure DevOps Information Disclosure Vulnerability |
Remote Code Execution Vulnerabilities
| CVE | CVE Title |
| CVE-2026-32161 | Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability |
| CVE-2026-33109 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability |
| CVE-2026-33110 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-33112 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-33844 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability |
| CVE-2026-34329 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
| CVE-2026-34332 | Windows Kernel-Mode Driver Remote Code Execution Vulnerability |
| CVE-2026-35421 | Windows GDI Remote Code Execution Vulnerability |
| CVE-2026-35439 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-40357 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-40358 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-40359 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-40361 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2026-40362 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-40363 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-40364 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2026-40365 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-40366 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2026-40367 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2026-40368 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-40370 | SQL Server Remote Code Execution Vulnerability |
| CVE-2026-40380 | Windows Volume Manager Extension Driver Remote Code Execution Vulnerability |
| CVE-2026-40403 | Windows Graphics Component Remote Code Execution Vulnerability |
| CVE-2026-40415 | Windows TCP/IP Remote Code Execution Vulnerability |
| CVE-2026-41089 | Windows Netlogon Remote Code Execution Vulnerability |
| CVE-2026-41094 | Microsoft Data Formulator Remote Code Execution Vulnerability |
| CVE-2026-41096 | Windows DNS Client Remote Code Execution Vulnerability |
| CVE-2026-41611 | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-42831 | Office for Android Remote Code Execution Vulnerability |
| CVE-2026-42833 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-42898 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
Security Feature Bypass Vulnerabilities
| CVE | CVE Title |
| CVE-2026-32209 | Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability |
| CVE-2026-33117 | Azure SDK for Java Security Feature Bypass Vulnerability |
| CVE-2026-35422 | Windows TCP/IP Driver Security Feature Bypass Vulnerability |
| CVE-2026-41097 | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2026-41109 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-41610 | Visual Studio Code Security Feature Bypass Vulnerability |
Spoofing Vulnerabilities
| CVE | CVE Title |
| CVE-2026-32207 | Azure Machine Learning Notebook Spoofing Vulnerability |
| CVE-2026-33833 | Azure Machine Learning Notebook Spoofing Vulnerability |
| CVE-2026-34327 | Microsoft Partner Center Spoofing Vulnerability |
| CVE-2026-35428 | Azure Cloud Shell Spoofing Vulnerability |
| CVE-2026-40379 | Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability |
| CVE-2026-41100 | Microsoft 365 Copilot for Android Spoofing Vulnerability |
| CVE-2026-41101 | Microsoft Word for Android Spoofing Vulnerability |
| CVE-2026-41102 | Microsoft PowerPoint for Android Spoofing Vulnerability |
| CVE-2026-41614 | M365 Copilot for Desktop Spoofing Vulnerability |
| CVE-2026-42832 | Microsoft Office Spoofing Vulnerability |
Tampering Vulnerability
| CVE | CVE Title |
| CVE-2026-32175 | .NET Core Tampering Vulnerability |
| CVE-2026-42893 | Microsoft Outlook for iOS Tampering Vulnerability |
Share This Article
An Article By
An Article By
Security News
Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.
