Loading story…
Microsoft's May security release addressed 120 vulnerabilities across Windows, Office, .NET, Azure, Teams, and SharePoint, with no publicly reported zero-days at disclosure. The most urgent on-premises issues included multiple authenticated SharePoint Server remote code execution flaws—CVE-2026-33110, CVE-2026-33112, CVE-2026-35439, and CVE-2026-40357—that let users with low site-level privileges such as Site Member or Site Owner execute arbitrary code remotely through unsafe deserialization. Microsoft shipped cumulative updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, and noted there are no workarounds for the affected builds.
The same release also patched a large set of local privilege escalation bugs across Windows and related components, including the TCP/IP stack (CVE-2026-34351), Win32k (CVE-2026-35417), the Windows kernel (CVE-2026-35420, CVE-2026-33841), Event Logging Service (CVE-2026-33834), Cloud Files Mini Filter Driver (CVE-2026-34337), Storage Spaces Controller (CVE-2026-35415), Office Click-to-Run (CVE-2026-35436), .NET (CVE-2026-32177, CVE-2026-35433), and Azure Monitor Agent on Linux (CVE-2026-32204). Microsoft also disclosed several high-severity cloud-service vulnerabilities that were already remediated server-side, including flaws in Azure DevOps, Azure Cloud Shell, Azure Managed Instance for Apache Cassandra, Azure Machine Learning, Microsoft 365 Copilot Business Chat, Teams Events Portal, Azure Monitor, and Azure AI Foundry, meaning most customers did not need to patch those hosted services directly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
By 2026-05-18, Microsoft had addressed CVE-2026-42822 in Azure Local Disconnected Operations, applying server-side mitigation for Azure Resource Manager environments and requiring ALDO customers to update to version 2604.2.25645 or later. The flaw could allow full privilege escalation over the network when an attacker had access to the internal ALDO network and relevant identity context.
On 2026-05-12, Microsoft released updated Office Click-to-Run builds to fix CVE-2026-35436, an access control weakness that could let a low-privilege local attacker escape AppContainer and gain SYSTEM privileges. The issue affected Click-to-Run Office deployments rather than MSI-based installations.
On 2026-05-12, Microsoft disclosed and patched CVE-2026-33833 in Azure Machine Learning Notebooks. The fix was delivered in version 1.7.6 of the @azure-notebooks component, with no workaround provided.
On 2026-05-12, Microsoft fixed CVE-2026-32204 in Azure Monitor Agent by releasing build 1.14.0. The flaw allowed a low-privilege local user on Linux to gain root through path and filename manipulation in configuration message handling.
On 2026-05-12, Microsoft released fixes for .NET elevation-of-privilege flaws CVE-2026-32177 and CVE-2026-35433. Updated runtime versions were issued for supported .NET release lines, and the guidance included updating runtimes, SDKs, and republishing self-contained applications where needed.
On 2026-05-12, Microsoft fixed a broad set of Windows local privilege escalation vulnerabilities affecting the TCP/IP stack, Win32k ICOMP, Storage Spaces Controller, Windows Kernel, Event Logging Service, Cloud Files Mini Filter Driver, and other kernel components. The updates were distributed through Patch Tuesday cumulative updates and, for some platforms, hotpatches.
On 2026-05-12, Microsoft patched several authenticated remote code execution flaws in on-premises SharePoint Server, including CVE-2026-33110, CVE-2026-33112, CVE-2026-35439, and CVE-2026-40357. The fixes were delivered through cumulative updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, with no workarounds documented.
On 2026-05-12, Microsoft issued its May 2026 Patch Tuesday updates covering 120 vulnerabilities across Windows, Office, SharePoint, .NET, Azure components, and other products. Multiple references note that none of the vulnerabilities were marked as publicly exploited at release time.
On 2026-05-07, Microsoft publicly disclosed a set of cloud-service vulnerabilities affecting Azure DevOps, Azure Cloud Shell, Azure Managed Instance for Apache Cassandra, Azure Machine Learning, Azure Monitor, Teams Events Portal, Microsoft 365 Copilot Business Chat, Edge Copilot Chat, and Azure AI Foundry M365 agents. The referenced advisories state these issues had already been mitigated server-side and required no customer action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
36 references tracked. Mallory keeps watching after this page renders.
gs.statcounter.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcedevblogs.microsoft.com
Open sourceaka.ms
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jun 29, 2026
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Jun 29, 2026
Microsoft released fixes for **163 CVEs** across 17 product families, including **8 Critical** vulnerabilities, **1 publicly disclosed** flaw, and **1 vulnerability under active exploitation**. The exploited issue, `CVE-2026-32201`, is a **Microsoft SharePoint Server spoofing vulnerability** that can let an unauthenticated attacker impersonate a user and read or modify certain data. Microsoft also patched `CVE-2026-33825`, a **publicly disclosed Microsoft Defender elevation-of-privilege flaw** that affects systems only when Defender is enabled; the company said customers using Defender automatic updates are remediated automatically. Among the most severe issues, Microsoft highlighted `CVE-2026-33824`, a **Critical Windows Internet Key Exchange (IKE) Service Extensions remote code execution vulnerability** with a **CVSS 9.8**, and advised defenders to restrict **UDP ports 500 and 4500** until patching is complete. Elevation-of-privilege bugs made up the largest share of the release with **94 CVEs**, while **Windows** accounted for **131** of the patched vulnerabilities. Microsoft said **24 flaws** were more likely to be exploited within 30 days, **18** carried CVSS scores of **8.0 or higher**, and the release also included **80 Edge-related advisories**, most inherited from Chrome.
Jun 29, 2026