Microsoft Patch Tuesday May 2026 Fixes 137 Flaws, Including Netlogon RCE and Critical SSO Bypass

Microsoft's May 2026 security update addresses 137 vulnerabilities (30 Critical, 103 Important) across Windows, Hyper-V, .NET, M365 Copilot, and other products; notable issues include unauthenticated RCEs and EoP bugs such as a Netlogon stack overflow (CVE-2026-41089), Office/Word RCEs, a Windows GDI heap overflow, and a Hyper-V use-after-free that could yield SYSTEM access — organizations should prioritize patching these high-impact flaws despite Microsoft reporting no publicly disclosed zero-days this cycle.