Rapid7Adam Barnett
Microsoft Patch Tuesday patches Netlogon and DNS RCE flaws
On May 12, 2026, Microsoft released patches for 137 vulnerabilities during Patch Tuesday. Key highlights include:
1. **CVE-2026-41089**: A critical RCE in Windows Netlogon, CVSS score 9.8, allowing SYSTEM privilege escalation without user interaction.
2. **CVE-2026-41096**: Critical RCE in the Windows DNS client, CVSS score 9.8, though exploitation is seen as less likely due to mitigations in place.
3. **CVE-2026-41103**: Critical elevation of privilege vulnerability in the Entra ID auth plugin for JIRA/Confluence, with exploitation rated more likely.
4. Microsoft's WARP team has been acknowledged for multiple vulnerabilities, suggesting advanced AI research efforts.
5. **Lifecycle Updates**: No major updates, though .NET 9 STS has an extended support end date.
Additionally, detailed vulnerability charts and tables categorized by impact and type provide further insights into the month’s security landscape.
Story timeline CVE-2026-41089
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 19:20 UTC | SANS ISC | Microsoft May 2026 Patch Tuesday, (Tue, May 12th) |
| Tue 12 May · 21:31 UTC | Dark Reading | Microsoft Patch May 2026 fixes 137 bugs, zero day free |
| Tue 12 May · 22:10 UTC | Krebs on Security | Patch Tuesday, May 2026 Edition |
| Wed 13 May · 02:31 UTC | Rapid7 | Microsoft Patch Tuesday patches Netlogon and DNS RCE flaws (this article) |
| Wed 13 May · 08:31 UTC | Infosecurity | Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs |
| Wed 13 May · 12:11 UTC | SOCRadar | May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days |
| Wed 13 May · 20:32 UTC | Security Affairs | Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming |
| Mon 1 Jun · 02:47 UTC | SecurityOnline | Netlogon RCE bug CVE-2026-41089 exposes domain controllers |
| Mon 1 Jun · 15:21 UTC | SecurityWeek | Belgium flags active exploitation of CVE-2026-41089 Netlogon flaw |