May 2026 Patch Tuesday: 137 Flaws Including Critical Windows Netlogon RCE

Microsoft dropped 137 security fixes this May 2026 Patch Tuesday — and one of them is serious enough that if you run a Windows domain controller and you haven’t patched it yet, stop reading and go patch it right now. I’ll explain why in a moment.

Rapid7 — a well-known vulnerability research firm with over 160K followers on LinkedIn and one of the most credible voices in enterprise security — flagged the critical Windows Netlogon bug as the standout this month. They’re right. Here’s everything you need to know, in plain English.

What Is May 2026 Patch Tuesday And Why Does It Happen Every Month?

If you’re not an IT professional, here’s a quick explainer. Microsoft releases security updates on the second Tuesday of every month — hence “Patch Tuesday.” Think of it like your phone getting an app update, except these updates are closing doors that hackers could walk through on your computer or company network.

This month’s release is a big one. Microsoft published fixes for 137 vulnerabilities across Windows, Office, Edge, and other products. On top of that, there are 133 additional browser-specific patches — those aren’t even counted in the 137 figure. So the real total is closer to 270 fixes in one go. That’s a lot.

Not all vulnerabilities are equal. Some are low-risk nuisances. Others — like the Netlogon one — are genuinely dangerous and need immediate attention. The CVE (Common Vulnerabilities and Exposures) system gives each flaw a unique ID. The CVSS score (Common Vulnerability Scoring System) rates severity from 0 to 10. Anything above 9.0 is considered critical. The bug we’re talking about today scores 9.8.

CVE-2026-41089: The Windows Netlogon Flaw That Should Keep IT Teams Up At Night

Let’s talk about the headline vulnerability: CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon with a CVSS v3 base score of 9.8 out of 10.

What is Windows Netlogon? It’s the service that handles authentication between computers and domain controllers on a corporate network. In plain English — it’s the gatekeeper that checks whether your username and password are valid when you log into your work computer. Every organisation running Active Directory (which is basically every mid-to-large company on the planet) uses this.

Here’s the thing about a stack-based buffer overflow: it means an attacker can send specially crafted data to this service and cause it to execute their own code. Not just crash the system — actually run whatever code they want, in the context of the domain controller. That means full control of your entire company network in many cases.

What concerns me most here is the attack surface. Domain controllers are the crown jewels of any Windows-based corporate network. If an attacker gets remote code execution (RCE) on a domain controller, it’s effectively game over — they can create accounts, access every file, push out ransomware to every connected machine. I’ve seen this pattern before with Netlogon vulnerabilities. Remember Zerologon (CVE-2020-1472) back in 2020? That one was also a 10.0 CVSS Netlogon bug and it got exploited hard and fast. This one scored nearly as high.

Microsoft says they’re not aware of active exploitation yet. That’s good news — but historically, attackers reverse-engineer patches within days of release. The window to act is narrow.

The Other 136 Fixes: What Else Is In This Month’s Release

While CVE-2026-41089 is the one grabbing attention, May 2026 Patch Tuesday is notable just for its sheer volume. 137 vulnerabilities across the core Microsoft product stack, plus 133 browser fixes. That’s not typical. A standard month might see 60-90 CVEs. This month is roughly double that.

The 133 browser patches are mostly for Chromium-based Edge — Google’s open-source browser engine that Microsoft adopted for Edge several years back. When Google patches Chrome, Microsoft has to roll those same fixes into Edge. These don’t always make the main Patch Tuesday count but they matter if your employees are browsing the web all day (and they are).

For IT teams prioritising what to tackle first: the Netlogon RCE is your immediate priority. After that, look for any other Critical-rated CVEs in the release, especially anything affecting Windows Server, Exchange, or SharePoint — these tend to have the broadest attack surface in enterprise environments.

What This Means For India, UAE, Saudi Arabia, UK and USA Users

India: This one hits close to home for Indian IT. Companies like Infosys, Wipro, TCS, HCL and Tech Mahindra manage Windows Active Directory environments for thousands of enterprise clients globally. A Netlogon vulnerability at this severity level puts pressure on Indian IT service providers to push emergency patches to client environments — sometimes before those clients have even been notified. If you work at a large Indian IT firm and you manage Windows infrastructure, your team should have already been alerted. If not, that’s a process problem worth raising.

UAE and Saudi Arabia: The Gulf region has seen massive investment in enterprise IT infrastructure over the past five years — Vision 2030 in Saudi and the UAE’s Smart Government initiative have pushed thousands of government and semi-government entities onto Windows-based networks. Domain controllers running Netlogon are everywhere in these environments. Government IT teams and private sector IT managers here should treat this patch as P1 — meaning patch tonight, not next week.

UK and USA: In regulated industries — finance, healthcare, legal — patch compliance isn’t optional. In the UK, NHS Trusts and financial institutions under FCA oversight need to document patch timelines. In the US, if you fall under HIPAA, PCI-DSS, or CISA directives, an unpatched 9.8-rated CVE on a domain controller is the kind of thing that shows up in audit findings and breach investigations. CISA typically issues a Known Exploited Vulnerabilities (KEV) directive quickly when a critical Netlogon flaw is confirmed exploited. Get ahead of it.

Digi Trendz Expert Take

Here’s my honest read on May 2026 Patch Tuesday: the volume alone — 270 fixes when you include the browser patches — tells me Microsoft’s attack surface has grown significantly. More features, more integrations, more code paths that can break. That’s not a criticism, it’s just the reality of a complex software ecosystem.

What surprises me about the Netlogon bug specifically is that we’ve been here before. Zerologon in 2020 was a watershed moment that should have triggered a fundamental redesign of how Netlogon handles authentication. The fact that we’re seeing another critical stack-based buffer overflow in the same service six years later raises real questions about whether that redesign happened thoroughly enough.

For everyday users on home Windows PCs — honestly, this one isn’t targeting you directly. You don’t run a domain controller at home. But your employer’s IT team is scrambling right now, and that matters to you because a ransomware attack on your company’s domain controller means your files, your payroll system, your email — all of it could go dark.

For small business owners running a Windows Server on-premises — even a small one with five users — if Windows Netlogon is running and exposed on your network, this patch needs to happen immediately. Don’t wait for your IT person’s next scheduled visit.

The broader signal from this month: patching cadence matters more than ever. A vulnerability that’s unpatched for even 72 hours after a public CVE disclosure is a vulnerability that sophisticated attackers will attempt to exploit. As Rapid7 regularly highlights in their research, the gap between patch release and first exploitation attempt keeps shrinking.

6 Specific Steps To Protect Your Systems Right Now

1. For Windows 10/11 home users — patch immediately: Go to Start → Settings → Windows Update → Check for updates. If you see May 2026 updates available, click Download and Install. Restart when prompted. Don’t defer this one.
2. For IT admins — prioritise CVE-2026-41089 on domain controllers: In Windows Server Update Services (WSUS), filter by Classification: Security Updates, Released: May 2026. Find the Netlogon patch, approve it for your domain controller OU first. Deploy and verify via Event Viewer → Windows Logs → System — look for Event ID 19 (update installed successfully).
3. For Microsoft Edge users — update your browser today: Open Edge, click the three-dot menu (…) → Help and feedback → About Microsoft Edge. It will check for updates automatically. Install any pending update and restart. Those 133 browser fixes apply here.
4. Enable automatic patching for Windows Server environments: In Windows Admin Center or Group Policy, navigate to Computer Configuration → Administrative Templates → Windows Components → Windows Update and set Configure Automatic Updates to option 4 (auto-download and schedule install). This won’t replace your patch testing process, but it ensures nothing sits unpatched for weeks.
5. Run a vulnerability scan against your domain controllers: Use Microsoft Baseline Security Analyzer (MBSA) or if you have it, Rapid7 InsightVM or Tenable Nessus — run a credentialed scan against your domain controllers specifically. Filter results by CVE-2026-41089 to confirm the patch has taken effect. Don’t assume — verify.
6. Check your network segmentation around domain controllers: Use Windows Firewall with Advanced Security (search for it in Start) to confirm that inbound connections to your domain controller on port 445 (SMB) and Netlogon-related ports are restricted to only trusted internal subnets. Exposing a domain controller directly to the internet — even on a VPN — is a configuration that turns a patchable vulnerability into an active emergency.

For more hands-on guides like this, check out our cybersecurity how-to guides — we try to keep them jargon-free and actually actionable.

Bottom Line

May 2026 Patch Tuesday is one of the heavier releases in recent memory — 137 core CVEs plus 133 browser fixes — and the Windows Netlogon RCE at CVSS 9.8 is not something you can afford to sit on. If you manage a domain controller, patch it now. If you’re a regular Windows user, run your Windows Update today. Microsoft hasn’t seen exploitation yet, but that window closes fast once patches are reverse-engineered — and it always gets reverse-engineered.