widely-deployed-product-advisoryprivilege-escalation-methodinternet-facing-service-vulnerabilitycloud-service-vulnerability

Microsoft fixes SharePoint RCEs and broad Windows privilege escalation flaws

Patch & Detection Intelligence · 36 sources · Updated 4mo ago · First seen May 18, 2026

Microsoft's May security release addressed 120 vulnerabilities across Windows, Office, .NET, Azure, Teams, and SharePoint, with no publicly reported zero-days at disclosure. The most urgent on-premises issues included multiple authenticated SharePoint Server remote code execution flaws—CVE-2026-33110, CVE-2026-33112, CVE-2026-35439, and CVE-2026-40357—that let users with low site-level privileges such as Site Member or Site Owner execute arbitrary code remotely through unsafe deserialization. Microsoft shipped cumulative updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, and noted there are no workarounds for the affected builds.

The same release also patched a large set of local privilege escalation bugs across Windows and related components, including the TCP/IP stack (CVE-2026-34351), Win32k (CVE-2026-35417), the Windows kernel (CVE-2026-35420, CVE-2026-33841), Event Logging Service (CVE-2026-33834), Cloud Files Mini Filter Driver (CVE-2026-34337), Storage Spaces Controller (CVE-2026-35415), Office Click-to-Run (CVE-2026-35436), .NET (CVE-2026-32177, CVE-2026-35433), and Azure Monitor Agent on Linux (CVE-2026-32204). Microsoft also disclosed several high-severity cloud-service vulnerabilities that were already remediated server-side, including flaws in Azure DevOps, Azure Cloud Shell, Azure Managed Instance for Apache Cassandra, Azure Machine Learning, Microsoft 365 Copilot Business Chat, Teams Events Portal, Azure Monitor, and Azure AI Foundry, meaning most customers did not need to patch those hosted services directly.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

9 events · May 7, 2026 – May 18, 2026

May 18, 20266mo ago
Microsoft mitigates Azure Local Disconnected Operations auth bypass
By 2026-05-18, Microsoft had addressed CVE-2026-42822 in Azure Local Disconnected Operations, applying server-side mitigation for Azure Resource Manager environments and requiring ALDO customers to update to version 2604.2.25645 or later. The flaw could allow full privilege escalation over the network when an attacker had access to the internal ALDO network and relevant identity context.
Brief Summary: CVE-2026-42822 - Azure Local Disconnected Operations Improper Authentication Leading to Full Privilege Escalation - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches Office Click-to-Run sandbox escape flaw
On 2026-05-12, Microsoft released updated Office Click-to-Run builds to fix CVE-2026-35436, an access control weakness that could let a low-privilege local attacker escape AppContainer and gain SYSTEM privileges. The issue affected Click-to-Run Office deployments rather than MSI-based installations.
Brief Summary: CVE-2026-35436 Elevation of Privilege in Microsoft Office Click-to-Run via Access Control Weakness - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches Azure ML Notebook markdown injection flaw
On 2026-05-12, Microsoft disclosed and patched CVE-2026-33833 in Azure Machine Learning Notebooks. The fix was delivered in version 1.7.6 of the @azure-notebooks component, with no workaround provided.
Brief Summary: Azure Machine Learning Notebook Spoofing via Markdown Injection (CVE-2026-33833) - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches Azure Monitor Agent Linux root escalation flaw
On 2026-05-12, Microsoft fixed CVE-2026-32204 in Azure Monitor Agent by releasing build 1.14.0. The flaw allowed a low-privilege local user on Linux to gain root through path and filename manipulation in configuration message handling.
Azure Monitor Agent CVE-2026-32204: Brief Summary of a Local Privilege Escalation via Path Manipulation - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches .NET privilege escalation vulnerabilities
On 2026-05-12, Microsoft released fixes for .NET elevation-of-privilege flaws CVE-2026-32177 and CVE-2026-35433. Updated runtime versions were issued for supported .NET release lines, and the guidance included updating runtimes, SDKs, and republishing self-contained applications where needed.
Brief Summary: CVE-2026-32177 - Heap Buffer Overflow in .NET Enables Local Privilege Escalation - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches multiple Windows local privilege escalation flaws
On 2026-05-12, Microsoft fixed a broad set of Windows local privilege escalation vulnerabilities affecting the TCP/IP stack, Win32k ICOMP, Storage Spaces Controller, Windows Kernel, Event Logging Service, Cloud Files Mini Filter Driver, and other kernel components. The updates were distributed through Patch Tuesday cumulative updates and, for some platforms, hotpatches.
Brief Summary: Windows TCP/IP Race Condition Privilege Escalation (CVE-2026-34351) - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft patches SharePoint deserialization RCE cluster
On 2026-05-12, Microsoft patched several authenticated remote code execution flaws in on-premises SharePoint Server, including CVE-2026-33110, CVE-2026-33112, CVE-2026-35439, and CVE-2026-40357. The fixes were delivered through cumulative updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, with no workarounds documented.
Brief Summary: CVE-2026-33110 - Microsoft SharePoint Server Remote Code Execution via Unsafe Deserialization - ZeroPath Blog | ZeroPath
May 12, 20266mo ago
Microsoft releases May 2026 Patch Tuesday fixes for 120 vulnerabilities
On 2026-05-12, Microsoft issued its May 2026 Patch Tuesday updates covering 120 vulnerabilities across Windows, Office, SharePoint, .NET, Azure components, and other products. Multiple references note that none of the vulnerabilities were marked as publicly exploited at release time.
Microsoft May 2026 Patch Tuesday - SANS Internet Storm Center
May 7, 20266mo ago
Microsoft discloses and server-side remediates multiple cloud service CVEs
On 2026-05-07, Microsoft publicly disclosed a set of cloud-service vulnerabilities affecting Azure DevOps, Azure Cloud Shell, Azure Managed Instance for Apache Cassandra, Azure Machine Learning, Azure Monitor, Teams Events Portal, Microsoft 365 Copilot Business Chat, Edge Copilot Chat, and Azure AI Foundry M365 agents. The referenced advisories state these issues had already been mitigated server-side and required no customer action.
Brief Summary: CVE-2026-33109 Critical RCE in Azure Managed Instance for Apache Cassandra (CVSS 9.9) - ZeroPath Blog | ZeroPath

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

15 linked

Local Privilege Escalation in Windows Event Logging Service (CVE-2026-33834)Windows TCP/IP Elevation of Privilege Race Condition (CVE-2026-34351)Remote Code Execution in Microsoft SharePoint Server via Insecure Deserialization (CVE-2026-40357)Remote Code Execution in Microsoft SharePoint Server Deserialization (CVE-2026-33112)Remote Code Execution in Microsoft SharePoint Server via Deserialization of Untrusted Data (CVE-2026-33110)Heap-Based Buffer Overflow Leading to Local Privilege Escalation in .NET (CVE-2026-32177)Microsoft Office Click-to-Run Elevation of Privilege Vulnerability (CVE-2026-35436)Local Privilege Escalation in Azure Monitor Agent (CVE-2026-32204)Windows Kernel Heap-Based Buffer Overflow Privilege Escalation (CVE-2026-35420)Local Privilege Escalation in Microsoft .NET Runtime (CVE-2026-35433)+5 more

Affected products

6 linked

Windows 11Sharepoint ServerWindows 10Windows Server 2025Windows Server 2022Azure Monitor Agent

Organizations

1 linked

Microsoft Corporation

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

36 references tracked. Mallory keeps watching after this page renders.

UnclassifiedNews · Jul 9, 2026

Desktop Operating System Market Share Worldwide | Statcounter Global StatsOpen source ↗

Zeropath BlogNews · May 18, 2026

Brief Summary: CVE-2026-42822 - Azure Local Disconnected Operations Improper Authentication Leading to Full Privilege Escalation - ZeroPath Blog | ZeroPathOpen source ↗

Zeropath BlogNews · May 13, 2026

Brief Summary: CVE-2026-35415 Windows Storage Spaces Controller Integer Overflow Privilege Escalation - ZeroPath Blog | ZeroPathOpen source ↗

Zeropath BlogNews · May 13, 2026

Microsoft SharePoint Server CVE-2026-35439: Brief Summary of an Authenticated Deserialization RCE - ZeroPath Blog | ZeroPathOpen source ↗

28 additional sources from 07-05-2026 to 13-05-2026

Zeropath BlogNews · May 7, 2026

Brief Summary: CVE-2026-33111 Command Injection in Microsoft Edge Copilot Chat Enables Network Information Disclosure - ZeroPath Blog | ZeroPathOpen source ↗

Zeropath BlogNews · May 7, 2026

Brief Summary: CVE-2026-33823 - Critical Improper Authorization in Microsoft Teams Events Portal - ZeroPath Blog | ZeroPathOpen source ↗

Microsoft Developer BlogsAdvisories · Apr 22, 2026

Introducing the new hosted agents in Foundry Agent Service: secure, scalable compute built for agents | Microsoft Foundry BlogOpen source ↗

UnclassifiedNews · Jun 27, 2024

Toward greater transparency: Unveiling Cloud Service CVEsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News