Infosecurity
Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs
Microsoft has issued security updates for May Patch Tuesday fixing 120 CVEs, 17 of which are classified as critical vulnerabilities. Of these, 14 are remote code execution (RCE) flaws, two are elevation of privilege (EoP) issues and one is an information disclosure vulnerability. The article notes a new multi-model agentic security system discovered 16 CVEs in this month’s Patch Tuesday.
Notable vulnerabilities highlighted include CVE-2026-41089, a critical, stack-based Netlogon RCE with a CVSS v3 base score of 9.8, and CVE-2026-41096, another critical RCE in the Windows DNS client with a CVSS of 9.8. A third significant entry is CVE-2026-42898, a critical RCE in Microsoft Dynamics 365 On-Premises that could allow an authenticated attacker with low privileges to execute code over the network.
According to Infosecurity Magazine, Rapid7’s Adam Barnett emphasised the risk to domain controllers and the need to prioritise remediation, while Action1’s Jack Bicer warned that exploitation could rapidly impact a large number of systems.
AI summary of the original article from Infosecurity, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made
Story timeline CVE-2026-41089
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 19:20 UTC | SANS ISC | Microsoft May 2026 Patch Tuesday, (Tue, May 12th) |
| Tue 12 May · 21:31 UTC | Dark Reading | Microsoft Patch May 2026 fixes 137 bugs, zero day free |
| Tue 12 May · 22:10 UTC | Krebs on Security | Patch Tuesday, May 2026 Edition |
| Wed 13 May · 02:31 UTC | Rapid7 | Microsoft Patch Tuesday patches Netlogon and DNS RCE flaws |
| Wed 13 May · 08:31 UTC | Infosecurity | Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs (this article) |
| Wed 13 May · 12:11 UTC | SOCRadar | May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days |
| Wed 13 May · 20:32 UTC | Security Affairs | Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming |
| Mon 1 Jun · 02:47 UTC | SecurityOnline | Netlogon RCE bug CVE-2026-41089 exposes domain controllers |
| Mon 1 Jun · 15:21 UTC | SecurityWeek | Belgium flags active exploitation of CVE-2026-41089 Netlogon flaw |