May 2026 Patch Tuesday: no zero-days but plenty to fix

Microsoft's May 2026 Patch Tuesday addresses 137 security vulnerabilities, including 31 critical ones, with a significant portion allowing remote code execution across various Windows services, Office, Azure, SharePoint, and graphics components. Notably, none of these vulnerabilities are being actively exploited as zero-days, which Microsoft defines as flaws without an official patch or security update¹. Despite the absence of zero-days, the release is still considered high-risk due to the potential for remote code execution. The patched vulnerabilities span multiple Microsoft products, emphasizing the need for prompt assessment and patching to mitigate potential attacks. This patch release underscores the importance of regular security updates, as the window for patching can close quickly, even in the absence of known zero-day exploits. The extensive nature of these patches highlights the ongoing need for vigilance in managing and securing Microsoft-based systems, making immediate exposure assessment crucial for practitioners.