Microsoft patches 137 vulnerabilities in May 2026 Patch Tuesday

Microsoft's Patch Tuesday is a monthly structured disclosure cycle, released on the second Tuesday of each month, through which the company addresses security vulnerabilities across Windows, Office, Azure, and related software. The format allows enterprise IT and security teams to plan, test, and stage updates systematically, though the urgency of any given month's release depends on the severity and exploitability of included flaws. The absence of zero-days in May 2026 is a notable distinction from several recent cycles in which Microsoft disclosed vulnerabilities already under active exploitation at time of patching. Variation in reported CVE and critical-flaw counts across outlets reflects differing scoping conventions - some vendors exclude third-party or advisory-only entries - rather than factual disagreement about the underlying release.