Category: Windows

If April 2026 was an avalanche of patches, May brings a welcome breather from zero-days but keeps the critical severity count high.

Microsoft’s fifth Patch Tuesday of 2026 has arrived, addressing 120 vulnerabilities in total. While it breaks a long-standing streak by featuring zero publicly disclosed or actively exploited zero-day flaws, the sheer volume of severe remote code execution (RCE) bugs demands attention.

The update contains 17 critical flaws affecting a wide range of enterprise products, including Windows Netlogon, DNS Client, Azure DevOps, and Microsoft Word.

Here is the breakdown of what you need to know, what to patch first, and what might break.

You can download an Excel spreadsheet with information about the patches that Microsoft released:

The May 2026 Patch Day overview

Executive Summary

• Release Date: May 12, 2026
• Total Vulnerabilities: 120
• Critical Vulnerabilities: 17
• Zero-Days: 0

Key Action Item: Administrators must prioritize patching network-exposed infrastructure, specifically domain controllers affected by the Netlogon vulnerability (CVE-2026-41089) and systems running the Windows DNS Client. Simultaneously, Microsoft Office installations need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities that can be triggered simply via the Windows Preview Pane.

Important Patches

• CVE-2026-41089 — Windows Netlogon Remote Code Execution Vulnerability
• CVE-2026-41096 — Windows DNS Client Remote Code Execution Vulnerability
• CVE-2026-42826 — Azure DevOps Information Disclosure Vulnerability
• CVE-2026-40364 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-40402 — Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2026-32185 — Microsoft Teams Spoofing Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5087544 (Windows 10) KB5089549 (Windows 11)	Security updates addressing OS-level RCEs in Netlogon, DNS Client, and Windows Graphics components (Win32k). Also resolves various Elevation of Privilege flaws across the Windows Kernel.

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched zero 0-day vulnerabilities this Patch Day, but addressed a heavy enterprise focus of critical remote code execution and information disclosure flaws.

Here is the critical overview:

CVE-2026-41089 (Windows Netlogon Remote Code Execution Vulnerability)

A critical stack-based buffer overflow flaw (CVSS 9.8) affecting Windows Netlogon. A remote, unauthenticated attacker could exploit this by sending a crafted network request to a Windows server running as a domain controller. If successful, this causes the Netlogon service to improperly handle the request, allowing the attacker to execute malicious code without requiring any prior access or credentials.

CVE-2026-41096 (Windows DNS Client Remote Code Execution Vulnerability)

This critical heap-based buffer overflow vulnerability (CVSS 9.8) affects the Windows DNS service. It allows remote code execution over the network and can be exploited by sending a malicious DNS response, triggering memory corruption within the Windows DNS client. Depending on the configuration, an unauthenticated attacker can achieve full RCE.

CVE-2026-42826 (Azure DevOps Information Disclosure Vulnerability)

This is the highest-rated flaw this month, boasting a perfect CVSS score of 10.0. While Microsoft withheld specific exploitation details, a perfect severity score indicates that unauthenticated attackers could potentially access highly sensitive enterprise data, credentials, and source code stored or handled in Azure DevOps.

CVE-2026-40361, CVE-2026-40364, CVE-2026-40366, CVE-2026-40367 (Microsoft Word RCE Vulnerabilities)

A cluster of critical vulnerabilities in Microsoft Word (CVSS 8.4) that allow an unauthorized attacker to execute code locally. Notably, these flaws can be triggered through the Windows Preview Pane, meaning a user only needs to preview a specially crafted document to be compromised, without ever fully opening the file.

CVE-2026-40402 (Windows Hyper-V Elevation of Privilege Vulnerability)

A severe flaw (CVSS 9.3) allowing for a guest-to-host escape in Windows Hyper-V. By targeting certain hardware device registers, an attacker operating from within a guest virtual machine can escape the isolated environment and gain SYSTEM privileges on the underlying host system.

First Steps: Your Patch Tuesday Strategy

• Prioritize Domain Controllers (Netlogon) and DNS Client services
• Address high-risk Azure deployments (DevOps, Cloud Shell)
• Update Office installations immediately to mitigate Preview Pane risks

The time to go brew a coffee whenever you start a taxing program on Windows could soon be a thing of the past. Reports by Windows Central and other sources suggest that Microsoft is testing a new Low Latency Profile feature that could speed up the start of apps by up to 70 percent.

The idea behind the feature is straightforward: Boost the processors frequency for certain taxing tasks on the system to speed them up. Examples are the opening of apps, system flyouts, or the display of menus on the system.

According to Windows Central, app starts could be boosted by up to 40 percent while the launch times of interfaces could be boosted up to 70 percent.

Depending on the PC that you are using, these things may happen near instantly already all the time. Deskmodder tested the feature in an Insider build recently and concluded that it does not really help, if the PC in question is modern.

However, when a PC is older, it could indeed speed up certain options noticeably.

The new feature is part of Microsoft’s effort to improve the performance and stability of the operating system. It is but one of the changes that Microsoft is testing currently. Others include optimizing apps or code, or switching to modern interfaces.

The new Low Latency Profile feature runs in the background automatically. Whether there will be an option in Settings or elsewhere to disable the feature remains to be seen. It is likely that there will be at least a Group Policy and Regedit option to manage that.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826 https://t.co/VW4xXmGdEa

— phantomofearth 🌳 (@phantomofearth) May 7, 2026

Phantom of Earth posted the relevant IDs for the feature on X.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826

Run .\vivetool /enable /id:60716524,61391826 in Terminal (elevated) to enable these.

Imagine trying to secure your PC’s most important files, only to discover that your trusted backup software has been actively locked out by the operating system itself. That is exactly what is happening to Windows 11 users this week, as Microsoft has officially confirmed in a recently updated support document that its latest patches (KB5083769 and KB5083631) are intentionally blocking popular third-party backup applications like Macrium Reflect.

The Redmond giant explained that this disruptive change is the result of a strict new security hardening measure, which actively adds the psmounterex.sys kernel driver to the Microsoft Vulnerable Driver Blocklist to protect systems from known exploits—leaving affected users dealing with timeout errors and broken disk image mounting.

Microsoft confirms the change and that third-party backup software may be affected on a new support page. However, the company has not added any information about potential issues to the official KB release notes, making it difficult for affected users and also system administrators to investigate the issue.

According to the company, users and IT administrators may observe the following behavior after installing April 2026 or later updates for Windows 11:

What new behavior should I expect?
Users and IT administrators might observe the following behavior after installing the update:

Backup applications that rely on the kernel driver psmounterex.sys might fail to mount backup image files as virtual drives.

Attempting to browse or restore from a backup image might result in errors or timeouts.

Failures might be followed by error messages, such as “The backup has failed because Microsoft VSS has timed out during the snapshot creation” or VSS_E_BAD_STATE.

Event Viewer might show Code Integrity errors indicating that psmounterex.sys was blocked from loading.

Backup creation (full image backups) may still succeed, but image-mount operations will fail.

Microsoft claims that the change is “designed to protect devices against known vulnerabilities in the psmounterex.sys kernel driver. That is exactly the driver that some backup apps, including Macrium Reflect, use for managing and mounting disk images.

The vulnerability that Microsoft mentions was discovered in certain versions of the driver in late 2023 already. If exploited, bad actors can use this flaw to escalate their privileges and execute arbitrary malicious code at the kernel level, completely compromising the system.

The result for users who run backup apps that rely on the driver: When a user tries to mount a backup image, the backup app attempts to load the psmounterex.sys driver. Windows Code Integrity enforcement steps in and actively blocks the driver from loading because it’s on the blacklist. Without the driver, the backup app cannot complete its task, leading to Volume Shadow Copy Service (VSS) timeouts and mounting errors.

In short, Microsoft is deliberately breaking the functionality of these apps to stop a known security loophole from being exploited at the kernel level.

Another one? That could be the reaction of veteran Windows users who read the headline. Microsoft confirmed another BitLocker related issue in Windows 11. This one may be caused by installing the most recent cumulative update for the operating system.

In the Known issues section of the update, Microsoft confirms that devices might boot into the BitLocker Recovery screen and not the desktop.

According to the description, the issue is caused by an “unrecommended BitLocker Group Policy configuration”. Only a “limited number of systems” are affected according to Microsoft. The company says that the issue affects only systems for which all of the following conditions are true:

• BitLocker is enabled on the OS drive.
• The Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually).
• System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as “Not Possible”.
• The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB), making the device eligible for the 2023‑signed Windows Boot Manager to be made the default.
• The device is not already running the 2023-signed Windows Boot Manager.

Devices that meet the conditions may boot into recovery mode after installing the KB508376 for Windows 11, versions 24H2 or 25H2.

A workaround is available to remove the Group Policy configuration before installing the update.

1. Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Set “Configure TPM platform validation profile for native UEFI firmware configurations” to “Not Configured“.
4. Run the following command on affected devices to propagate the policy change: gpupdate /force
5. Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: 
6. Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: 
7. ​​​​​​​This updates the BitLocker bindings to use the Windows-selected default PCR profile.

Microsoft plans to release a permanent fix in the future to address this. Windows users who use a Microsoft Account can look up the recovery key for BitLocker online.

When Microsoft introduced the two-tier context menu of Windows 11 it claimed that one reason for the change was to streamline the context menu of the operating system. This did not turn out too well, considering that users juggle between the new and the classic menu regularly since the release of Windows 11.

Apps may still add entries to the Windows context menu and since there is no central editor to manage all entries, it is either done through the app itself — if it offers such an option — or the Registry Editor.

Windows 11 Context Menu Manager is a free open source tool that offers another option. It focuses on items added by apps and not the Microsoft entries.

When you launch it, you see all context menu items in a list. The default scenario is to remove them for the user. You can also remove them machine-wide, but that requires running the app with elevated rights.

Each entry is listed with its name and some information. To be honest, this is not super useful, but it becomes useful when you expand the entry. There, you find information about file types.

To give you one example. The program listed two entries for Adobe Acrobat Reader. One was for PDF files, the other for any other file type that Acrobat Reader supported.

Even this advanced view is limited. The seven OneDrive entries did not reveal any information about their purpose when I expanded them. They were labeled command0, command1 and so on, and listed a wildcard under file and no directory.

With that in mind, you get an option to toggle the items off or on again. Other actions become available when you expand an item. There you find options to uninstall, open the file location, the settings of the app, or the Microsoft Store.

With those caveats, it is still a handy tool to hide certain items from the Windows 11 context menu, especially if the app does not provide options to do so in its preferences. (via Deskmodder)

If March 2026 was a marathon of infrastructure updates, April is a massive avalanche of patches.

Microsoft’s fourth Patch Tuesday of 2026 has arrived, addressing a massive 165 vulnerabilities in total. The sheer volume demands attention. It contains two 0-day vulnerabilities — one of which is actively exploited in the wild — and eight critical flaws affecting a wide range of products, including Office, SharePoint, Microsoft Defender, and Azure.

Here is the breakdown of what you need to know, what to patch first, and what might break.

The April 2026 Patch Day overview

Executive Summary

• Release Date: April 14, 2026
• Total Vulnerabilities: 165
• Critical Vulnerabilities: 8
• Zero-Days: 2 (SharePoint [Actively Exploited], Microsoft Defender [Publicly Disclosed])

Key Action Item: Administrators must prioritize patching internet-facing SharePoint servers due to the actively exploited spoofing zero-day. Simultaneously, network infrastructure and Active Directory components need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities.

Important Patches

• CVE-2026-32201 — Microsoft Office SharePoint Spoofing Vulnerability
• CVE-2026-33825 — Microsoft Defender Elevation of Privilege Vulnerability
• CVE-2026-33824 — Windows Internet Key Exchange (IKE) Extension Remote Code Execution Vulnerability
• CVE-2026-33827 — Windows TCP/IP Remote Code Execution Vulnerability
• CVE-2026-33826 — Windows Active Directory Remote Code Execution Vulnerability
• CVE-2026-23666 — .NET Denial of Service Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5082200 (Windows 10) KB5083768 (Windows 11, 26H1) KB5083769 (Windows 11, version 25H2 and 24H2)	Security updates addressing OS-level RCEs in TCP/IP, IKE, and Active Directory components. Also resolves numerous Elevation of Privilege (EoP) flaws across Windows Kernel, Boot Loader, and BitLocker.
Microsoft SharePoint Server		Patches for SharePoint 2016, 2019, and Subscription Edition to address the actively exploited CVE-2026-32201 spoofing flaw.
Microsoft Office		Security updates addressing multiple Critical Use-After-Free and Untrusted Pointer Dereference vulnerabilities resulting in local code execution

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched two 0-day vulnerabilities this Patch Day and several critical remote code execution flaws.

Here is the critical overview:

CVE-2026-32201 (Microsoft Office SharePoint Spoofing Vulnerability)

This actively exploited zero-day allows an unauthorized attacker to perform spoofing over a network due to improper input validation in Microsoft Office SharePoint. An attacker who successfully exploits this can view sensitive information and make changes to disclosed information.

CVE-2026-33825 (Microsoft Defender Elevation of Privilege Vulnerability)

A publicly disclosed zero-day flaw in Microsoft Defender that allows privilege escalation to SYSTEM privileges. Microsoft has addressed the flaw in the Microsoft Defender Antimalware Platform update version 4.18.26050.3011, which should be downloaded to (most) systems automatically.

CVE-2026-33824 (Windows Internet Key Exchange (IKE) Extension RCE)

A critical double-free vulnerability in the Windows IKE extension. An unauthenticated attacker can send specially crafted packets to a Windows machine with IKE version 2 enabled to potentially achieve remote code execution. If IKE is not in use, blocking inbound traffic on UDP ports 500 and 4500 acts as a mitigation.

CVE-2026-33827 (Windows TCP/IP Remote Code Execution)

A critical race condition vulnerability in Windows TCP/IP that can result in remote code execution. An unauthenticated actor can send specially crafted IPv6 packets to a Windows node where IPSec is enabled to potentially achieve RCE.

CVE-2026-33826 (Windows Active Directory Remote Code Execution)

A critical improper input validation flaw in Windows Active Directory. It allows an authenticated attacker to execute code over an adjacent network.

First Steps: Your Patch Tuesday Strategy

• Prioritize the SharePoint zero-day
• Address network and directory risks
• Update Office installations

If you’ve ever felt completely lost in the web of Windows testing tiers or frustrated by slow A/B feature rollouts, relief may finally have arrived.

Microsoft announced a big overhaul of the Windows Insider Program this week designed to simplify how users test development builds of the operating system.

The company is cutting down the channel list to just two primary ones — Beta and Experimental — and is finally changing how experimental features land on test systems.

Here is a breakdown of the major changes:

• Two Streamlined Channels: The previously confusing multi-tier system is being condensed into just two primary tracks: Experimental (which replaces the Dev and Canary channels) and Beta (for features that are closer to being ready for the public).
• The End of A/B Testing: Microsoft is officially dropping its Controlled Feature Rollout (CFR) system for Beta channel participants. This means no more waiting in the dark while other testers randomly receive new features before you do.
• Manual Feature Flags: You are finally getting direct control over your testing experience. Moving forward, Insiders can manually toggle new features on or off directly within Windows Settings as soon as they are documented in the changelogs.
• No More “Clean Install” Trap: Historically, leaving the Insider program or dropping down to a more stable channel often required a complete, data-wiping OS reinstall. Microsoft is fixing this by allowing in-place upgrades (IPU), meaning you can transition channels or exit the program while keeping your files and apps intact.
• Clearer Communication: Release notes and documentation will be much more explicit about who features are for and which channel they belong to, giving IT admins, developers, and enthusiasts a much more transparent roadmap of what to expect.

From a testing perspective, Microsoft is launching several improvements. First, Beta users get access to features directly. No more waiting or using of third-party tools like ViVeTool to enable them.

Second, users in the experimental channel get options to turn certain features on, if they are not already enabled.

Third, switching between channels should get easier and less cumbersome.

Last but not least, more documentation is always welcome, as Microsoft’s attempts have been lackluster at best until now.

While the announcement may instill hope in Windows testers who have been disappointed by Microsoft so far, it is clear that Microsoft has to deliver. If the company does, it could improve its Windows Insider program significantly in the process.