May 2026 Patch Tuesday: 139 Fixes Across Windows and Office, No Zero-Days but Critical Preview Pane RCEs Demand Urgent Action

Overview of May 2026 Patch Tuesday

Microsoft has released its May 2026 security updates, delivering 139 patches across Windows, Office, .NET, and SQL Server. Notably, this month contains no zero-day vulnerabilities, but the update still carries significant risk due to a handful of critical remote code execution (RCE) flaws and lingering configuration issues from previous months. The company is urging administrators to prioritize deployment for Windows and Office, especially given the presence of unauthenticated network RCEs and a dangerous Preview Pane exploit chain.

Key Vulnerabilities and Affected Products

The May batch includes three unauthenticated network RCEs affecting Netlogon, DNS Client, and the SSO Plugin for Jira and Confluence. Additionally, four critical RCEs in the Word Preview Pane (CVSS 8.4) can be triggered simply by previewing a malicious document in Outlook or File Explorer. A large cluster of TCP/IP vulnerabilities also demands attention. The Readiness team recommends an accelerated release schedule, starting with internet-facing services, domain controllers, and Office endpoints. For a complete breakdown of risk by product family, consult the May 2026 Assurance Security Dashboard.

Known Issues and Remaining Concerns

Despite a generally clean bill of health for Windows 11 24H2, 23H2, Windows 10 22H2, and Windows Server 2025, two items require special attention.

BitLocker Recovery Condition Persists

Windows 10 and Windows Server customers remain exposed to the BitLocker recovery condition from the April 2026 update. This affects devices configured with the “Configure TPM platform validation profile for native UEFI firmware configurations” Group Policy and an invalid PCR7 profile. Microsoft has acknowledged the issue but no fix is included in this month’s release for those platforms.

Graphics Driver Downgrade Problem

On the Hardware Dev Center, Microsoft confirmed that Windows Update may replace manually-installed graphics drivers with older OEM versions from the catalogue. This happens because the ranking system uses four-part Hardware IDs rather than version numbers. “Customers who actively manage their display drivers experience unwanted downgrades through Windows Update,” the company stated.

Resolved Issues and Improvements

Several high-impact problems from previous months have been addressed in the May updates.

BitLocker Recovery Fix for Windows 11

KB5089549 for Windows 11 25H2 and 24H2 resolves the April PCR7/BitLocker recovery condition. It also improves Boot Manager servicing so subsequent boot file updates no longer trigger a recovery event.

Secure Boot Certificate Update

Secure Boot certificate distribution has been enhanced with a new folder, C:\Windows\SecureBoot, containing automation scripts for IT teams rolling out the Windows UEFI CA 2023 key replacement under CVE-2023-24932. This prepares systems for the 2011 certificate expirations, which occur between June and October 2026.

SSDP Notification Reliability

The Simple Service Discovery Protocol (SSDP) notification reliability has been improved, reducing the likelihood of the service becoming unresponsive under sustained load. This is particularly relevant for networks running UPnP device discovery.

Critical Word Preview Pane RCEs – Mitigation Advice

Microsoft has issued mitigation guidance for the four Word Preview Pane RCEs disclosed this month:

• CVE-2026-40361 – Critical, CVSS 8.4, “Exploitation More Likely”
• CVE-2026-40364 – Critical, CVSS 8.4, “Exploitation More Likely”
• CVE-2026-40366 – Critical, CVSS 8.4
• CVE-2026-40367 – Critical, CVSS 8.4

The attack vector is the Preview Pane in Outlook and File Explorer. Simply viewing a malicious document — without even opening it — is enough to trigger exploitation. Administrators are advised to disable the Preview Pane where possible and apply the updates immediately. For a full list of CVEs and workarounds, visit the Microsoft Security Response Center.

With no zero-days but a high concentration of remotely exploitable flaws, including those that require no user interaction beyond previewing a file, the May 2026 Patch Tuesday demands a swift, prioritized rollout. Start with internet-facing servers, domain controllers, and any systems that handle untrusted documents.