Microsoft’s Patch Tuesday Update Targets 120 Security Flaws

Microsoft released its May 2026 Patch Tuesday update on May 13, fixing 120 security flaws across Windows and other products. Among these, 31 were remote code execution (RCE) vulnerabilities and 61 were privilege escalation flaws. No zero-day exploits were listed at the time of release, though IT teams were urged to prioritize the update due to the risk of attackers exploiting newly patched systems. The update covered Windows 11 versions 24H2/25H2 (KB5089549) and 23H2 (KB5087420), while eligible Windows 10 devices received security updates only (KB5087544). Feature improvements included File Explorer enhancements, expanded archive format support, voice typing refinements, and the introduction of Xbox Mode for gaming on Windows PCs. Windows 10 updates focused on Remote Desktop warnings, Secure Boot, and a Daylight Saving Time adjustment for Egypt. The vulnerabilities were categorized into privilege elevation (61), RCE (31), information disclosure (14), spoofing (13), denial of service (8), and security feature bypass (6). Exploiting these flaws could allow attackers to execute admin-level commands, remotely control devices, steal data, impersonate trusted services, disrupt operations, or bypass security protections like SmartScreen. Microsoft emphasized the importance of applying updates promptly, as attackers often exploit newly disclosed vulnerabilities to target unpatched systems. The update also included reliability improvements and performance enhancements, such as faster startup app loading and better haptic feedback for compatible pen accessories.