Microsoft's 138-Patch Drop Puts DNS and Netlogon RCE Front and Center

138 Patches, Zero Active Exploits — But Don't Relax

Microsoft's May 2026 Patch Tuesday is a heavy one: 138 vulnerabilities across the product portfolio, with 30 landing at Critical severity. The silver lining is that none are listed as publicly known or actively exploited at time of release. That window won't stay open indefinitely, so treat this cycle as a sprint, not a stroll.

The breakdown by class is worth sitting with: 61 privilege escalation bugs dominate the count. That's not surprising in isolation, but it signals something we keep seeing across the industry — attackers who already have a foothold are being handed reliable ladders. If your detection coverage for local privilege escalation is thin, this patch cycle is a forcing function to fix that.

DNS and Netlogon: The Two You Patch First

The headlines are the DNS Server RCE and Netlogon RCE flaws, both rated Critical. Let's be direct about why these two matter more than the rest of the list.

DNS Server RCE on a Windows DNS server means an unauthenticated or low-barrier attacker can potentially execute arbitrary code on infrastructure that is almost always domain-joined, often a domain controller, and trusted implicitly by everything else on the network. Windows DNS and Active Directory are deeply coupled in most enterprise environments. A compromised DNS server is a pivot point into AD that bypasses a lot of conventional detection.

Netlogon RCE carries even more historical weight. Netlogon is the authentication backbone between domain members and domain controllers. The name alone will trigger flashbacks to Zerologon (CVE-2020-1472), which became one of the most weaponized vulnerabilities of that era. This new flaw is a different bug, but the attack surface is identical: any environment running Windows Server with the Netlogon service exposed to untrusted or semi-trusted network segments is in scope. Patch your domain controllers first. If you run tiered AD administration, your Tier 0 assets are the priority — full stop.

Privilege Escalation at Scale

Sixty-one EoP bugs in a single patch cycle is a number that should inform your detection strategy, not just your patching queue. A few things worth doing now:

• Audit your local admin surface. EoP bugs are most dangerous where attackers already have user-level code execution. Reducing unnecessary local admin rights shrinks the blast radius.
• Check your EDR coverage for known EoP techniques — token impersonation, named pipe abuse, service misconfigurations. If a newly patched technique was already in an attacker's toolkit, your detections need to be current regardless of patch status.
• Prioritize workstations and servers where interactive logon happens. That's where initial access typically lands before an EoP bug gets chained.

Severity Distribution and Patch Prioritization

With 104 Important-rated vulnerabilities alongside the 30 Critical ones, there's a real risk of alert fatigue driving teams to batch the Important fixes into a slower cycle. We'd push back on that instinct here. Important-rated flaws in Microsoft's taxonomy still include RCE and EoP classes — the rating reflects exploitability likelihood and authentication requirements, not just potential impact. Review the Important tier for any RCE or EoP classifications before deprioritizing.

The three Moderate and one Low severity findings are largely noise for most operators this cycle — triage accordingly.

Operational Notes

• Domain controllers first, specifically for Netlogon and DNS patches.
• Test DNS patches in staging if you run split-brain DNS or custom forwarder configurations — DNS service disruptions during patching are a common source of self-inflicted outages.
• FortiGate and other perimeter device operators: this is a Windows-centric patch cycle, but if you're running Windows-based management infrastructure behind your FortiGate estate, the Netlogon and DNS fixes apply there too.
• Confirm your patch management tooling is picking up the full 138 — large Patch Tuesday releases occasionally see stragglers in WSUS or third-party patch platforms.

None of these flaws are confirmed exploited in the wild yet, but the combination of Netlogon RCE and a 61-strong EoP collection is exactly the kind of patch cycle threat actors study closely. The gap between patch release and weaponized exploit continues to compress. Treat this week as the deadline, not the starting gun.

Full vulnerability details and Microsoft's official advisories are available via The Hacker News' coverage, which links through to the Microsoft Security Update Guide.