Microsoft’s May 2026 Patch Tuesday Updates Fix 30 Critical Flaws

Microsoft has released the May 2026 Patch Tuesday updates for Windows 11. This month, Microsoft has fixed a total of 138 security flaws in Windows, Office, Microsoft Edge, Azure, .NET and Visual Studio, Copilot Chat, GitHub Copilot, and Microsoft 365 Copilot.

On the quality and experience updates front, the KB5089548 update (26H1) brings enhancements to Narrator and strengthens Smart App Control. It also enhances pen settings and introduces a redesigned “About” page in Settings. It also adds more Microsoft 365 promotions within Settings and delivers small usability improvements to File Explorer.

138 vulnerabilities fixed in the May 2026 Patch Tuesday updates

According to the Zero Day Initiative, Microsoft’s May 2026 Patch Tuesday Updates include fixes for 138 vulnerabilities. Among these, only 30 are categorized as “Critical,” 3 are deemed “Moderate,” one is rated ” Low, ” and the rest carry an “Important” severity rating. Let’s take a look at some of the more interesting updates for this month.

• CVE-2026-41096: This is a critical Windows vulnerability in the DNS client caused by a memory overflow flaw, which can be triggered remotely by sending a specially crafted DNS response. If exploited, it allows an attacker to run arbitrary code on the target system without authentication, which potentially leads to full system compromise.
• CVE‑2026‑41089: This is a critical vulnerability in Windows Netlogon that allows an unauthenticated attacker to execute code on a domain controller by sending a specially crafted network request. It can give attackers powerful control over authentication systems that potentially leads to full domain compromise.
• CVE‑2026‑42898: This is a critical code‑injection flaw in Microsoft Dynamics 365 (on‑premises) that allows an authenticated attacker to execute malicious code over a network. If exploited, it can lead to full system compromise, allowing attackers access to modify or disrupt sensitive data and services.
• CVE-2026-40415: This is a high‑severity vulnerability in the Windows TCP/IP stack caused by a use‑after‑free memory error, which can be triggered remotely using specially crafted network packets. It could allow an unauthenticated attacker to execute arbitrary code over the network, potentially taking full control of the affected system

Here’s the complete list of resolved vulnerabilities in the May 2026 Patch Tuesday updates:

Quality and experience updates

The KB5089549 update for Windows 11 version 24H2 and 25H2 introduces various new features, security fixes, and performance improvements. The list of key features includes new expanded archive format support in File Explorer, improved haptic feedback for compatible input devices, and a redesigned voice typing interface, along with enhancements to taskbar responsiveness and Windows Hello reliability.

This update also strengthens system stability and security by fixing BitLocker boot issues, improving startup and networking reliability, updating Secure Boot handling, and applying numerous security patches.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.