# Microsoft May 2026 Patch Tuesday — 137 CVEs, 31 Critical (16 RCE) Including CVE-2026-41089 Pre-Auth Netlogon Stack Overflow on Domain Controllers

> Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities (120 Microsoft-only per BleepingComputer after excluding Mariner/Azure/Copilot/Teams/Partner Center entries), with 31 rated Critical and 16 of those Critical entries enabling Remote Code Execution. No vulnerabilities were actively exploited or disclosed as zero-days at release. The headline flaw is CVE-2026-41089, a CVSS 9.8 stack-based buffer overflow in Windows Netlogon (CWE-121) that lets an unauthenticated network attacker execute code on Windows servers acting as domain controllers — a Zerologon-class domain-takeover primitive. Additional pre-auth or low-friction network RCEs span the DNS Client (CVE-2026-41096, CVSS 9.8, heap overflow on attacker-controlled DNS response), Windows GDI (CVE-2026-35421, CVSS 7.8 EMF via Microsoft Paint), SharePoint Server (CVE-2026-40365, CVSS 8.8 authenticated), Native WiFi Miniport Driver (CVE-2026-32161, CVSS 7.5 adjacent-network UAF + race), Win32k-GRFX (CVE-2026-40403, CVSS 8.8 local EoP), Dynamics 365 on-premises (CVE-2026-42898, CVSS 9.9 code injection), and Azure Managed Instance for Apache Cassandra (CVE-2026-33109/33844, CVSS 9.9/9.0). Multiple critical Office/Word RCEs (CVE-2026-40358/40361/40363/40364/40366/40367/42831) chain through preview-pane-reachable attachments. The 61 Elevation-of-Privilege CVEs in the batch dominate the EoP slice typical for monthly rollups.

- **Published:** 2026-05-12T18:30:00Z
- **Last reviewed:** 2026-05-12T18:30:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0504
- **ID:** TL-2026-0504
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41089, CVE-2026-41096, CVE-2026-35421, CVE-2026-40365, CVE-2026-32161, CVE-2026-40403, CVE-2026-40402, CVE-2026-33109, CVE-2026-33844, CVE-2026-40358, CVE-2026-40361, CVE-2026-40363, CVE-2026-40364, CVE-2026-40366, CVE-2026-40367, CVE-2026-42831, CVE-2026-42898

## Description

## Patch Tuesday Composition

Microsoft's May 2026 security update batch resolves 137 unique CVEs across the Microsoft product portfolio. After filtering out Mariner Linux distribution, Azure dataplane, Copilot, Teams, and Partner Center advisories — the slice BleepingComputer counts separately — the core Microsoft surface accounts for 120 vulnerabilities. The severity composition is heavily weighted toward privilege escalation (61 EoP) but the operationally relevant slice for external defenders is the 31 Critical entries, 16 of which permit Remote Code Execution and a handful of which are reachable without authentication. Cisco Talos confirms that none of the disclosed vulnerabilities were observed in active exploitation at release, and Microsoft tagged no entries with Exploited:Yes in MSRC. This drops the immediate urgency below the historical 'pure CRITICAL' bar reserved for in-the-wild zero-days while preserving HIGH urgency due to the pre-auth Netlogon and DNS Client RCEs.

## CVE-2026-41089 — Netlogon Pre-Auth Stack Overflow (CRITICAL, CVSS 9.8)

A stack-based buffer overflow (CWE-121) in the Windows Netlogon service permits an unauthenticated network attacker to execute code on a Windows server operating as a domain controller via a specially crafted Netlogon network request. The flaw is structurally similar to the historical Zerologon (CVE-2020-1472) and Netlogon RPC family of issues that have repeatedly been weaponized for domain takeover. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector indicates a complete pre-auth network compromise primitive: any unauthenticated host with network reachability to the DC's RPC interface (typically tcp/445 SMB, tcp/135 EPM, tcp/49152-65535 dynamic RPC) can trigger the overflow. Stack overflows in lsass-hosted services on modern Windows still face mitigations (stack cookies/GS, CFG, ASLR, DEP), but successful exploitation results in code execution in the security context of the Netlogon service — effectively SYSTEM on the DC, equating to immediate Domain Admin equivalence. The Talos write-up explicitly highlights this as the headline flaw of the release. Cisco published Snort coverage in SIDs 1:66438-1:66445 and 1:66451-1:66460 (Snort 2) and 1:301494-1:301497 / 1:301500-1:301506 (Snort 3) covering the May batch network-protocol primitives, with overlapping detection logic for the Netlogon, DNS, and SharePoint RCEs.

## CVE-2026-41096 — Windows DNS Client Heap Overflow (CRITICAL, CVSS 9.8)

A heap-based buffer overflow (CWE-122) in the Windows DNS Client triggers when the client parses a maliciously crafted DNS response. The attack model: any system path that causes the target Windows host to perform a DNS resolution against an attacker-controlled or attacker-influenced authoritative server — including environments where DNS resolution can be coerced (link resolution in Office documents, MoTW-bypassing URLs, captive portals, attacker-poisoned LAN with rogue DHCP supplying a malicious DNS server) — results in heap corruption inside dnsapi/dnsrslvr code paths and unauthenticated code execution. Because the DNS Client is invoked transparently during virtually every networked operation, the exposure is exceptionally broad. Pre-auth network attack vector with no user interaction (AV:N/UI:N) and SYSTEM-level service host context elevate this to the same operational risk band as the Netlogon flaw, though exploitation requires the target to issue a DNS request the attacker can answer.

## CVE-2026-35421 — Windows GDI EMF Heap Overflow (CRITICAL, CVSS 7.8)

A heap-based buffer overflow (CWE-122) in the Windows GDI subsystem is reachable when a user opens or otherwise processes a specially crafted Enhanced Metafile (EMF) using Microsoft Paint. Local AV:L with UI:R reduces the headline CVSS, but EMF parsing surfaces also include the Explorer thumbnail pipeline and Office image insertion paths, broadening practical exposure beyond Paint. Successful exploitation grants code execution in the user's context and is a classic single-click drive-by attachment primitive that pairs well with phishing (T1566.001) and User Execution (T1204.002).

## CVE-2026-40365 — SharePoint Server Authenticated RCE (CRITICAL, CVSS 8.8)

Insufficient granularity of access control (CWE-1220) in Microsoft SharePoint Server permits a low-privileged authenticated user to perform a network-based attack that remotely executes code on the SharePoint server. The vector matches the high-value SharePoint exploitation lineage (ToolShell, CVE-2024-38094, CVE-2025-49706/49707), targeting on-prem SharePoint deployments that frequently service Office automation, ETL connectors, and AD-integrated SSO — making them stepping stones into broader enterprise compromise.

## CVE-2026-32161 — Native WiFi Miniport Driver Adjacent RCE (CRITICAL, CVSS 7.5)

A concurrent-execution race condition (CWE-362) combined with a use-after-free (CWE-416) in the Windows Native WiFi Miniport Driver permits an attacker on an adjacent network (AV:A) to execute code in the kernel-mode driver context with no authentication. Exploitation primitives in wireless miniport drivers historically yield ring-0 code execution, bypassing user-mode mitigations entirely. Operationally relevant to laptops in coffee-shop, conference, and airport environments — the classic 'evil twin AP' adjacent-attack model. AC:H reflects the timing/race precision required, but successful PoCs in this driver family have appeared rapidly in the past (e.g., CVE-2022-21893, CVE-2024-30078).

## CVE-2026-40403 — Win32k Graphics Component Local EoP (CRITICAL, CVSS 8.8)

A heap-based buffer overflow (CWE-122) in the Win32k graphics component grants an authenticated local attacker the ability to execute code at the kernel level (Scope:Changed reflecting the user-to-kernel boundary jump). Win32k EoP primitives are the post-exploitation backbone of nearly every modern Windows malware sample and the historical target of Kaspersky, ESET, and CrowdStrike-tracked Win32k zero-days. Combined with any of the user-context RCEs in this batch (Office, GDI), this provides a complete user-to-SYSTEM chain.

## CVE-2026-42898 — Dynamics 365 On-Premises Code Injection (CRITICAL, CVSS 9.9)

Improper control of code generation (CWE-94, code injection) in Microsoft Dynamics 365 on-premises permits an authorized low-privilege attacker (PR:L) to inject and execute arbitrary code over the network with Scope:Changed impact. Dynamics 365 deployments commonly run with elevated service accounts integrated into Active Directory, SQL Server, and SSRS — code execution here typically transitively reaches connected database and AD assets.

## CVE-2026-33109 / CVE-2026-33844 — Azure Managed Instance for Apache Cassandra (CRITICAL, CVSS 9.9 / 9.0)

Improper access control (CWE-284) and improper input validation (CWE-20) in the Cassandra managed-service surface allow an authenticated attacker to escape the tenant boundary and execute code in the managed-service context, with Scope:Changed indicating multi-tenant impact. Patched by Azure platform — customer action is awareness rather than remediation.

## Office / Word Critical RCE Cluster (CVE-2026-40358, 40361, 40363, 40364, 40366, 40367, 42831)

A cluster of seven critical Office/Word RCEs combines use-after-free (CWE-416), heap overflow (CWE-122), type confusion (CWE-843), and untrusted pointer dereference (CWE-822) primitives. All are AV:L (local file open), but the preview-pane and Outlook auto-render attack surfaces make these effectively one-click in operational practice. The cluster is the standard monthly Office harvest used by mass-distribution droppers (Emotet/Qakbot lineage) and APT spearphishing (Storm-1811, Cobalt Mirage observed reusing prior Office CVEs within 14-30 days of disclosure).

## Patch Reference Numbers

- Windows 11 23H2/24H2: KB5089549, KB5087420
- Windows 10 Extended Support: KB5087544

## Defensive Priority Order

1. Patch domain controllers immediately to remediate CVE-2026-41089. Until patched, restrict RPC dynamic-port access and enforce Netlogon secure channel signing+sealing.
2. Patch Windows endpoints to remediate CVE-2026-41096; harden DNS resolver path by enforcing DoH/DoT or fixed trusted resolvers.
3. Patch SharePoint, Office/Word, and Win32k components on high-value workstations and document servers.
4. Patch WiFi-enabled mobile fleet before next off-premises travel cycle.
5. Deploy Talos Snort coverage SIDs 1:66438-66476 and Snort 3 1:301494-301506 on network sensors.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1203 Exploitation for Client Execution
- T1204.002 User Execution: Malicious File
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1574 Hijack Execution Flow
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1606 Forge Web Credentials
- T1482 Domain Trust Discovery
- T1087.002 Account Discovery: Domain Account
- T1210 Exploitation of Remote Services
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1213.002 Data from Information Repositories: SharePoint
- T1071.004 Application Layer Protocol: DNS
- T1071.001 Application Layer Protocol: Web Protocols
- T1531 Account Access Removal
- T1489 Service Stop

## Sources

- [Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2026-patch-tuesday-fixes-120-flaws-no-zero-days/)
- [Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-may-2026/)
- [NVD — CVE-2026-41089 (Netlogon Stack Overflow RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-41089)
- [NVD — CVE-2026-41096 (DNS Client Heap Overflow RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-41096)
- [NVD — CVE-2026-35421 (Windows GDI EMF Heap Overflow)](https://nvd.nist.gov/vuln/detail/CVE-2026-35421)
- [NVD — CVE-2026-40365 (SharePoint Server Authenticated RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-40365)
- [NVD — CVE-2026-32161 (Native WiFi Miniport Driver Adjacent RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-32161)
- [NVD — CVE-2026-40403 (Win32k Graphics Local EoP)](https://nvd.nist.gov/vuln/detail/CVE-2026-40403)
- [NVD — CVE-2026-42898 (Dynamics 365 on-premises Code Injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-42898)
- [NVD — CVE-2026-33109 (Azure Cassandra Improper Access Control)](https://nvd.nist.gov/vuln/detail/CVE-2026-33109)
- [Historical reference: CVE-2020-1472 Zerologon (Netlogon protocol class)](https://nvd.nist.gov/vuln/detail/CVE-2020-1472)
- [MITRE ATT&CK — T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE ATT&CK — T1203 Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203/)
- [MITRE ATT&CK — T1068 Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0504