Krebs on SecurityBrianKrebs
Patch Tuesday, May 2026 Edition
Artificial intelligence platforms are becoming adept at identifying security vulnerabilities in software, evident in recent updates from major companies like Microsoft, Apple, Mozilla, and Oracle. In the latest Patch Tuesday, Microsoft addressed 118 vulnerabilities, including 16 classified as 'critical,' with no emergency zero-days reported. Key vulnerabilities include:
- CVE-2026-41089: Critical buffer overflow in Netlogon granting SYSTEM privileges.
- CVE-2026-41096: Remote Code Execution (RCE) in Windows DNS, though exploitation is deemed less likely.
- CVE-2026-41103: Elevation of privilege vulnerability allowing unauthorized user impersonation.
Apple addressed over 52 vulnerabilities in iOS 15, while Mozilla's Firefox 150 fixed 271 vulnerabilities. Oracle improved its patching frequency following its collaboration with Project Glasswing. Google fixed 127 security flaws in Chrome, marking an increase from the previous month.
Story timeline CVE-2026-41089
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 19:20 UTC | SANS ISC | Microsoft May 2026 Patch Tuesday, (Tue, May 12th) |
| Tue 12 May · 21:31 UTC | Dark Reading | Microsoft Patch May 2026 fixes 137 bugs, zero day free |
| Tue 12 May · 22:10 UTC | Krebs on Security | Patch Tuesday, May 2026 Edition (this article) |
| Wed 13 May · 02:31 UTC | Rapid7 | Microsoft Patch Tuesday patches Netlogon and DNS RCE flaws |
| Wed 13 May · 08:31 UTC | Infosecurity | Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs |
| Wed 13 May · 12:11 UTC | SOCRadar | May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days |
| Wed 13 May · 20:32 UTC | Security Affairs | Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming |
| Mon 1 Jun · 02:47 UTC | SecurityOnline | Netlogon RCE bug CVE-2026-41089 exposes domain controllers |
| Mon 1 Jun · 15:21 UTC | SecurityWeek | Belgium flags active exploitation of CVE-2026-41089 Netlogon flaw |