What happened
Microsoft's May 2026 Patch Tuesday, released May 12, addressed 120 vulnerabilities across Windows, Office, Azure, developer tools and Microsoft 365 apps, according to BleepingComputer's count of the release. Help Net Security, Cybersecurity News and The Cyber Express independently reported the same figure. Of those, 31 were remote code execution flaws, 61 were elevation-of-privilege bugs, 14 were information disclosure issues and eight were denial-of-service flaws, per Cybersecurity News' breakdown of Microsoft's advisory data.
The notable detail was what was missing. For the first time in nearly two years, Microsoft shipped a monthly update with no vulnerability confirmed as actively exploited in the wild, a point Dark Reading led with in its headline "It's Patch Tuesday for Microsoft & Not a Zero-Day In Sight." Malwarebytes and BleepingComputer both confirmed the same finding independently.
The SharePoint flaw
The update's most consequential fix was CVE-2026-40365, a critical remote code execution vulnerability in Microsoft SharePoint Server, carrying a CVSS score of 8.8. According to vulnerability write-ups from Action1, SentinelOne and Rapid7, the flaw stems from insufficient granularity of access control: an authenticated attacker holding only Site Owner-level permissions can send crafted requests to a vulnerable SharePoint endpoint, where a coarse authorization check fails to distinguish read operations from code-affecting ones, letting attacker-controlled logic execute in the context of the SharePoint application pool identity.
Microsoft's advisory, as summarized by SentinelOne, states the flaw was not publicly disclosed and not exploited in the wild at the time of publication. Microsoft's own exploitability index rated exploit code maturity "Unproven" and exploitation "Less Likely." The affected products are SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016 Enterprise. Fixes are distributed through the relevant cumulative update packages, including KB5002870 for SharePoint Server 2019, as documented by Windows Forum's tracking of the release.
Two Word bugs reachable from Outlook's preview pane
Microsoft also patched CVE-2026-40361 and CVE-2026-40364, a pair of critical Word vulnerabilities each scoring 8.4 on CVSS and flagged by Microsoft's Exploitability Index as "Exploitation More Likely," a label the company reserves for flaws it expects to see a functional proof-of-concept for within 30 days.
Coverage from Capa One and Fortified Health Security describes CVE-2026-40361 as a use-after-free vulnerability in a DLL shared between Word and Outlook's rendering engine. Because Outlook's Preview Pane uses that same rendering path, simply selecting a malicious email in Outlook, without opening the attachment, is enough to trigger memory corruption and hand an attacker code execution at the logged-in user's privilege level. Microsoft's advisory confirms the Preview Pane as a valid attack vector for this pair.
Separately, CVE-2026-35421, a heap-based buffer overflow in the Windows GDI subsystem, was also patched. Rapid7 and SentinelOne describe it as triggered when a specially crafted Enhanced Metafile (EMF) file is opened or processed, including through Microsoft Paint, and it affects a wide span of supported Windows client and server versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025.
Who is affected
Organizations running any supported version of SharePoint Server on-premises are affected by CVE-2026-40365, particularly those that have granted broad Site Owner access as a matter of convenience rather than least privilege. SharePoint Online in Microsoft 365 is not implicated in this specific advisory. Any organization running Outlook or Word on Windows is exposed to the preview-pane RCE pair, and any Windows installation that processes EMF files, a format still used by print spoolers, legacy line-of-business tools and Paint, is exposed to the GDI flaw.
What affected parties should know
None of the three flaws detailed above were listed as exploited at the time Microsoft published the advisories. That distinguishes this cycle from months where CISA's Known Exploited Vulnerabilities catalog forced emergency patching timelines. It does not remove urgency: Microsoft's own "Exploitation More Likely" rating on the Word pair signals the company's threat intelligence team expects working exploits within roughly a month, and the SharePoint flaw's authentication bar is low enough that any environment with loose internal permissions should treat it as a priority patch rather than a routine one.
What happens next
Security teams typically get a wider testing window in a Patch Tuesday cycle with no live exploitation, and several trackers, including CrowdStrike's monthly analysis, framed May as an opportunity for an orderly rollout rather than an emergency one. The real test comes over the following weeks: whether proof-of-concept code surfaces for CVE-2026-40361, CVE-2026-40364 or CVE-2026-40365 and whether CISA subsequently adds any of them to its Known Exploited Vulnerabilities catalog, which would trigger binding remediation deadlines for federal agencies and signal broader in-the-wild activity to everyone else.
Sources: BleepingComputer: Microsoft May 2026 Patch Tuesday · Help Net Security: Microsoft May 2026 Patch Tuesday · Cybersecurity News: Microsoft Patch Tuesday May 2026 · Dark Reading: Patch Tuesday, No Zero-Day In Sight · Rapid7: CVE-2026-40365 · SentinelOne: CVE-2026-40365 · CrowdStrike: Patch Tuesday Analysis May 2026