BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Microsoft

May 2026 Security Updates

2026-May May 12, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-May
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

210 lines
All 210 CVEs 210 Additional recognition 0 Unclaimed only
Showing 1–50 of 210 · page 1 of 5
CVE-2026-40379 BR2026-0000-002514 unclaimed
Azure Entra ID Spoofing Vulnerability
Credited as Sridhar Periyasamy
CVE-2026-40379 BR2026-0000-002515 unclaimed
Azure Entra ID Spoofing Vulnerability
Credited as Thomas Knudson
CVE-2026-32207 BR2026-0000-002516 unclaimed
Azure Machine Learning Notebook Spoofing Vulnerability
Credited as Jianyang Song
CVE-2026-33109 BR2026-0000-002517 unclaimed
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Credited as Sharath Unni
CVE-2026-40412 BR2026-0000-002518 unclaimed
Azure Orbital Spatio Remote Code Execution Vulnerability
Credited as Michal Kamensky with Microsoft
CVE-2026-23652 BR2026-0000-002519 unclaimed
Microsoft Power Pages Remote Code Execution Vulnerability
Credited as Erik Donker with Microsoft
CVE-2026-35430 BR2026-0000-002520 unclaimed
Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
Credited as Sridhar Periyasamy with Microsoft
CVE-2026-40411 BR2026-0000-002521 unclaimed
Azure Virtual Network Gateway Remote Code Execution Vulnerability
Credited as Shay Shavit with Microsoft
CVE-2026-47280 BR2026-0000-002522 unclaimed
Azure Resource Manager Elevation of Privilege Vulnerability
Credited as Sridhar Periyasamy
CVE-2026-42827 BR2026-0000-002523 unclaimed
M365 Copilot Information Disclosure Vulnerability
Credited as Microsoft Office Security Team
CVE-2026-41090 BR2026-0000-002524 unclaimed
Microsoft Copilot Tampering Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-26147 BR2026-0000-002525 unclaimed
Azure Stack HCI Information Disclosure Vulnerability
Credited as Michal Kamensky with Microsoft
CVE-2026-33843 BR2026-0000-002526 unclaimed
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Credited as Alexander Tan with SecureSAML
CVE-2026-32204 BR2026-0000-002527 unclaimed
Azure Monitor Agent Elevation of Privilege Vulnerability
Credited as P1hcn
CVE-2026-33117 BR2026-0000-002528 unclaimed
Azure SDK for Java Security Feature Bypass Vulnerability
Credited as sho odagiri with GMO CyberSecurity by ierae inc
CVE-2026-33834 BR2026-0000-002529 unclaimed
Windows Event Logging Service Elevation of Privilege Vulnerability
Credited as George Hughey with MSRC Vulnerabilities
CVE-2026-33834 BR2026-0000-002530 unclaimed
Windows Event Logging Service Elevation of Privilege Vulnerability
Credited as Mitigations
CVE-2026-34329 BR2026-0000-002531 unclaimed
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Credited as Azure Yang with Kunlun Lab
CVE-2026-34330 BR2026-0000-002532 unclaimed
Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34331 BR2026-0000-002533 unclaimed
Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34333 BR2026-0000-002534 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34342 BR2026-0000-002535 unclaimed
Windows Print Spooler Elevation of Privilege Vulnerability
Credited as Marcin Wiazowski working with TrendAI Zero Day Initiative
CVE-2026-34343 BR2026-0000-002536 unclaimed
Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability
Credited as Erik Egsgard with Field Effect
CVE-2026-34344 BR2026-0000-002537 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-34344 BR2026-0000-002538 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Puponia
CVE-2026-34345 BR2026-0000-002539 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-34347 BR2026-0000-002540 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34350 BR2026-0000-002541 unclaimed
Windows Storport Miniport Driver Denial of Service Vulnerability
Credited as Microsoft Offensive Research
CVE-2026-34350 BR2026-0000-002542 unclaimed
Windows Storport Miniport Driver Denial of Service Vulnerability
Credited as Security Engineering
CVE-2026-34351 BR2026-0000-002543 unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-35415 BR2026-0000-002544 unclaimed
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Credited as Jan Vojtesek with SentinelOne
CVE-2026-35416 BR2026-0000-002545 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-35417 BR2026-0000-002546 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as Owen McCullough
CVE-2026-35419 BR2026-0000-002547 unclaimed
Windows DWM Core Library Information Disclosure Vulnerability
Credited as Sergey immortalp0ny Tarasov with Positive Technologies
CVE-2026-35419 BR2026-0000-002548 unclaimed
Windows DWM Core Library Information Disclosure Vulnerability
Credited as namnp with Viettel Cyber Security
CVE-2026-35420 BR2026-0000-002549 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Jongseong Kim (nevul37), SEC-agent team
CVE-2026-35420 BR2026-0000-002550 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Hwiwon Lee (hwiwonl), SEC-agent team
CVE-2026-35420 BR2026-0000-002551 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Younggi Park (grill66), SEC-agent team
CVE-2026-35421 BR2026-0000-002552 unclaimed
Windows GDI Remote Code Execution Vulnerability
Credited as pwn2addr
CVE-2026-35422 BR2026-0000-002553 unclaimed
Windows TCP/IP Driver Security Feature Bypass Vulnerability
Credited as Microsoft
CVE-2026-35423 BR2026-0000-002554 unclaimed
Windows 11 Telnet Client Information Disclosure Vulnerability
Credited as Microsoft
CVE-2026-35424 BR2026-0000-002555 unclaimed
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Credited as Microsoft
CVE-2026-35438 BR2026-0000-002556 unclaimed
Windows Admin Center Elevation of Privilege Vulnerability
Credited as sho odagiri with GMO Cybersecurity by Ierae inc
CVE-2026-35439 BR2026-0000-002557 unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as f7d8c52bec79e42795cf15888b85cbad
CVE-2026-35440 BR2026-0000-002558 unclaimed
Microsoft Word Information Disclosure Vulnerability
Credited as tiebuchen
CVE-2026-40360 BR2026-0000-002559 unclaimed
Microsoft Excel Information Disclosure Vulnerability
Credited as f4
CVE-2026-40360 BR2026-0000-002560 unclaimed
Microsoft Excel Information Disclosure Vulnerability
Credited as Zhiniang Peng with HUST
CVE-2026-40363 BR2026-0000-002561 unclaimed
Microsoft Office Remote Code Execution Vulnerability
Credited as Jeongmin Choi with S2W
CVE-2026-40364 BR2026-0000-002562 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as tiebuchen
CVE-2026-40366 BR2026-0000-002563 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as tiebuchen