Microsoft May 2026 Patch Tuesday: 120 CVEs Fixed, Word Preview-Pane RCE Added to CISA's Known Exploited Vulnerabilities Catalog

The most dangerous fix in Microsoft’s May 2026 Patch Tuesday drop is CVE-2026-40364 — a critical remote code execution vulnerability in Microsoft Word that executes code the moment a victim previews a malicious document in Windows Explorer or Outlook. No double-click required.

CVE-2026-40364 carries a CVSS base score of 8.4 and affects all supported editions of Word, Microsoft 365 Apps for Enterprise, and Office LTSC. Microsoft assessed it as “more likely to be exploited” — and security researchers confirmed limited targeted attacks were already happening before the patch dropped. CISA added it to the Known Exploited Vulnerabilities catalog on May 13, mandating federal agencies to patch within three weeks.

The preview-pane attack vector is what elevates this above a typical document flaw. Macro execution requires deliberate user action; preview triggers automatically as you navigate folders. Phishing lures with crafted document attachments are trivially weaponizable against this bug.

Other Critical CVEs This Month

The May 2026 update fixes 120 total vulnerabilities — 29 rated critical — across Windows, Office, Azure, and developer tooling. Two others warrant immediate attention:

CVE-2026-40380 (CVSS 9.8) — Remote code execution in volmgr.sys, the kernel-mode driver responsible for managing Windows storage volumes. An attacker landing this bug achieves kernel-level code execution. No public proof-of-concept yet, but a CVSS 9.8 without a PoC historically doesn’t stay that way for long.

CVE-2026-40402 (CVSS 9.0) — A use-after-free in Windows Hyper-V that allows a guest VM attacker to escape to the host. Virtualization escape bugs are rare and high-value; treat this one as actively exploitable even without public confirmation. Cloud providers running multi-tenant Windows workloads should treat this as the highest-priority item in the batch.

How to Patch

Windows Update will surface all fixes automatically for home users. Enterprise environments: use WSUS or SCCM and prioritize CVE-2026-40364, CVE-2026-40380, and CVE-2026-40402. Microsoft 365 Apps updates via Microsoft Update or the Office Deployment Tool. Test the volmgr.sys patch (CVE-2026-40380) in staging before broad rollout — kernel storage driver changes occasionally surface boot issues on specific hardware configurations.

For CVE-2026-40364, consider disabling the Preview Pane in Outlook and Windows Explorer as a temporary workaround while testing the patch in managed environments. Microsoft provides registry keys to accomplish this centrally via Group Policy.