Patch Tuesday May 2026: Two CVSS 9.8 Criticals — Every UK SME Has 48 Hours to Act

On Tuesday 13 May 2026, Microsoft shipped fixes for 137 CVEs — 30 of them rated critical, 14 carrying CVSS scores of 9.0 or higher, and zero classed as actively exploited zero-days for the first time since June 2024. That headline calm is misleading. Two of the criticals demand action from every UK SME inside 48 hours: CVE-2026-41089, a wormable stack-based buffer overflow in Windows Netlogon that hands an attacker SYSTEM-level control of a domain controller, and CVE-2026-41096, an unauthenticated heap-based overflow in the Windows DNS Client that affects every Windows endpoint on the estate. A third critical — CVE-2026-42898 in on-premises Dynamics 365 — carries CVSS 9.9 and turns any unpatched on-prem CRM into a launchpad.

This is the largest May Patch Tuesday in five years, and it lands inside the same calendar quarter that Microsoft’s April release pushed 169 CVEs — the second-highest single month in the programme’s history. Microsoft’s own AI tooling (MDASH) found 16 of the 137 bugs disclosed today, and the company is on pace to surpass the 2020 record of 1,245 CVEs in a calendar year. The implication for UK SMEs is operational: patching has stopped being an end-of-month admin task and has become a monthly compliance discipline that Cyber Essentials Plus, cyber insurers, and supplier security questionnaires now grade you on.

What Microsoft actually shipped on 13 May 2026

The May 2026 Patch Tuesday rollup covers 137 individual CVEs across Windows client and server, Microsoft Office, Dynamics 365, Azure DevOps, Microsoft Edge, SQL Server, Visual Studio, and the Microsoft SSO Plugin for Atlassian. Thirty of the entries are rated Critical, 14 carry CVSS scores of 9.0 or higher, and none was classified as exploited in the wild before publication — the first ‘clean’ Patch Tuesday for known-exploited bugs since June 2024.

That zero-day count is the part headlines have led with, but it is the wrong number to plan around. The two CVSS 9.8 entries — Netlogon (CVE-2026-41089) and the Windows DNS Client (CVE-2026-41096) — are both pre-authentication, both reachable over the wire, and both Microsoft-labelled as ‘Exploitation More Likely’. Once proof-of-concept code lands on GitHub, the gap between disclosure and the first credential-spraying worm has been measured in days, not weeks, on every comparable Netlogon-family bug since Zerologon in August 2020.

For UK SMEs the question is not whether the Tuesday rollup is ‘quiet’. The question is whether your domain controllers, your DNS resolvers and your Dynamics 365 on-prem servers are inside the 48-hour critical-patch SLA your Cyber Essentials Plus assessor — and increasingly your insurer — expect to see evidenced.

Patch Tuesday timeline — how today fits the wider 2026 picture

Where the 137 CVEs sit — severity and product breakdown

The headline number obscures a steep distribution. Roughly one in five entries is rated Critical, and the Critical pile is heavily concentrated in Windows core services. Office, Edge and Visual Studio carry the long tail of Important-rated bugs. The chart below is the operational view UK SME IT leaders should be planning against, not the press-release count.

Adobe, in step with Microsoft Patch Tuesday, pushed 32 vulnerabilities across 10 products including 2 criticals in Adobe Connect. SAP shipped 15 new advisories, two of them critical. The May ecosystem footprint — Microsoft, Adobe and SAP combined — runs to 184 CVEs on a single Tuesday. The era of ‘monthly patching’ as a Saturday-evening afterthought is over.

The 30 Critical CVEs — how the priority pile breaks down

Of the 137 entries, 30 are rated Critical. Inside that critical pile, the split between remote code execution (RCE), elevation of privilege (EoP) and information disclosure is what determines how aggressively each one needs to be sequenced. RCE on a network-reachable Windows service is the four-alarm category — that is exactly where Netlogon and DNS Client sit.

RCE makes up 61% of the Critical entries this month. Elevation of privilege accounts for another 23% (7 CVEs — including the on-prem Dynamics 365 entry), and the remainder splits between security feature bypass, spoofing, and information disclosure. For a UK SME running a typical hybrid estate — domain controllers on Server 2019/2022, Windows 11 endpoints, Microsoft 365 for mail, and SQL Server on-prem — that means at least four asset classes need patching inside the same fortnight.

Where most UK SMEs fail this rollup

The same eight gaps come up on every Cyber Essentials Plus audit, every cyber-insurance application, and every supplier security questionnaire we see. They are not exotic. They are the structural patch-management failures that turn a Microsoft Patch Tuesday into a board-level incident a month later.

Cost of getting May 2026 wrong — the realistic UK SME envelope

The cost of an unpatched Netlogon-class bug is not theoretical. The price points below are drawn from the public ICO penalty register, the latest Cyber Security Breaches Survey (CSBS 2025), and Cloudswitched incident-recovery engagements for businesses between 10 and 250 employees. They assume one productive working week of disruption, externally led incident response, and either a partial backup recovery or rebuild.

The numbers above exclude regulatory penalty exposure under UK GDPR (where Active Directory compromise typically triggers a notifiable personal-data breach), and they exclude the indirect cost of being struck off a supplier panel after the post-incident questionnaire round. Both line items, in our experience, frequently exceed the direct incident-response cost.

Reactive vs proactive — the two operating postures heading into Wednesday

The 10-step UK SME action plan for the May 2026 rollup

This is the operational sequence Cloudswitched runs on Managed IT Support estates inside the first 14 days of every Patch Tuesday. Each step is a separate gate — you do not advance until the prior gate has documented evidence. The percentage on each row indicates the typical position of an SME with a mature patching programme by Day 14.

Your May 2026 patch-readiness score

If you have a documented monthly patching SLA, a separate DC patch ring with snapshots, escrowed BitLocker keys, and a compliance evidence pack you can hand to an assessor on demand, you are scoring at the top of the gauge below. If even one of those is missing, you are not patch-ready for the volume the 2026 calendar is delivering.

A score of 37/100 is not a moral failing. It is what happens when patching is treated as a help-desk admin task rather than a board-level compliance discipline. The good news: the seven structural fixes above shift the average score to 78/100 within a single quarter, and they do not require a single piece of new hardware.

The May 2026 Patch Tuesday — at a glance

Related Cloudswitched coverage — the wider 2026 patching picture

The May 2026 rollup does not sit in isolation. It is the third Patch-Tuesday-class advisory in 30 days — on top of an active Palo Alto firewall zero-day and a WordPress plugin takeover wave that has already cost UK SMEs operating their own marketing sites. Read the full series for the operational pattern: the NCSC patch-wave warning and UK SME vulnerability management plan sets out the documented SLA approach NCSC now expects. The Palo Alto PAN-OS zero-day action plan covers the parallel firewall vector. The WordPress mass-takeover web stack audit covers the third-party CMS dimension. The Microsoft 365 Copilot Anthropic default opt-in guide covers the EU Data Boundary governance change that landed at the same time as April Patch Tuesday. The Veeam 3-2-1-1-0 cloud backup plan covers the backup-side controls that pay for themselves the first time a patch fails. And the PSTN switch-off VoIP plan covers the parallel deadline-driven workstream every UK SME is now running alongside their patching programme.

FAQ — UK SME Patch Tuesday May 2026

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.