Skip to content
Noroxi

Patch TuesdayMay 2026

On the second Tuesday of each month Microsoft, Adobe, SAP, Siemens and Schneider Electric publish in bulk; Oracle on the third Tuesday of January, April, July and October. Records published that day, from our own database, sorted by action score: KEV and mature exploits first.

How it is computed: CNA stamp + publication date (two-day window, UTC). No claim of a one-to-one match with the vendor bulletin; out-of-band updates land on other days.

211 records · 0 KEV

Affecting your stack

This month's records that match the products and versions in your stack.

Sign in to see the ones matching your stack; records and notifications are free. →

Microsoft · May 12

125 · 0 KEV · 9 critical
  • CVE-2026-41089
    63This week

    Windows Netlogon Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 79%

    microsoft · windows server 2012May 12, 2026

  • CVE-2026-33112
    44Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 31%

    microsoft · sharepoint serverMay 12, 2026

  • CVE-2026-41096
    40Plan

    Windows DNS Client Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    microsoft · windows 11 23h2May 12, 2026

  • CVE-2026-33821
    39Monitor

    Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    microsoft · dynamics 365 customer insightsMay 12, 2026

  • CVE-2026-42823
    39Monitor

    Azure Logic Apps Elevation of Privilege Vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    microsoft · azure logic appsMay 12, 2026

  • CVE-2026-42898
    39Monitor

    Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

    CriticalCVSS 9.9No exploitEPSS 1%

    microsoft · dynamics 365May 12, 2026

  • CVE-2026-41103
    38Monitor

    Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

    CriticalCVSS 9.1No exploitEPSS 5%

    microsoft · confluence saml ssoMay 12, 2026

  • CVE-2026-40402
    37Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    microsoft · windows 11 23h2May 12, 2026

  • CVE-2026-33110
    36Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    microsoft · sharepoint serverMay 12, 2026

  • CVE-2026-33117
    36Monitor

    Azure SDK for Java Security Feature Bypass Vulnerability

    CriticalCVSS 9.1No exploitEPSS 0%

    microsoft · azure sdk for javaMay 12, 2026

  • CVE-2026-35439
    36Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 2%

    microsoft · sharepoint serverMay 12, 2026

  • CVE-2026-40357
    36Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    microsoft · sharepoint serverMay 12, 2026

+113 moreAll records of the vendor

Adobe · May 12

51 · 0 KEV · 2 critical

+39 moreAll records of the vendor

SAP · May 12

14 · 0 KEV · 2 critical
  • CVE-2026-34260
    38Monitor

    SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)

    CriticalCVSS 9.6No exploitEPSS 0%

    sap_se · sap s/4hana (sap enterprise search for abap)May 12, 2026

  • CVE-2026-34263
    38Monitor

    Missing authentication check in SAP Commerce cloud configuration

    CriticalCVSS 9.6No exploitEPSS 0%

    sap_se · sap commerce cloud configurationMay 12, 2026

  • CVE-2026-34259
    32Monitor

    OS Command Injection Vulnerability in SAP Forecasting & Replenishment

    HighCVSS 8.2No exploitEPSS 0%

    sap_se · sap forecasting & replenishmentMay 12, 2026

  • CVE-2026-40135
    26Monitor

    OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

    MediumCVSS 6.5No exploitEPSS 1%

    sap · netweaver application server abapMay 12, 2026

  • CVE-2026-40133
    25Monitor

    Missing Authorization check in SAP S/4HANA Condition Maintenance

    MediumCVSS 6.3No exploitEPSS 0%

    sap_se · sap s/4hana condition maintenanceMay 12, 2026

  • CVE-2026-27682
    24Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)

    MediumCVSS 6.1No exploitEPSS 0%

    sap · netweaver application server abapMay 12, 2026

  • CVE-2026-40137
    24Monitor

    Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

    MediumCVSS 6.1No exploitEPSS 0%

    sap_se · business server pages application (taf_applauncher)May 12, 2026

  • CVE-2026-0502
    21Monitor

    Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform

    MediumCVSS 5.4No exploitEPSS 0%

    sap_se · sap businessobjects business intelligence platformMay 12, 2026

  • CVE-2026-40132
    21Monitor

    Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

    MediumCVSS 5.4No exploitEPSS 0%

    sap_se · sap strategic enterprise management (bsp application balanced scorecard wizard)May 12, 2026

  • CVE-2026-34258
    18Monitor

    Content Spoofing vulnerability in SAPUI5 (Search UI)

    MediumCVSS 4.7No exploitEPSS 0%

    sap_se · sapui5 (search ui)May 12, 2026

  • CVE-2026-40129
    17Monitor

    Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform

    MediumCVSS 4.3No exploitEPSS 0%

    sap_se · sap application server abap for sap netweaver and abap platformMay 12, 2026

  • CVE-2026-40134
    17Monitor

    Missing Authorization Check in SAP Incentive and Commission Management

    MediumCVSS 4.3No exploitEPSS 0%

    sap_se · sap incentive and commission managementMay 12, 2026

+2 moreAll records of the vendor

Siemens · May 12

18 · 0 KEV · 3 critical
  • CVE-2026-25786
    37Monitor

    Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface

    CriticalCVSS 9.3No exploitEPSS 0%

    siemens · simatic drive controller cpu 1504d tfMay 12, 2026

  • CVE-2026-25787
    37Monitor

    Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the

    CriticalCVSS 9.3No exploitEPSS 0%

    siemens · simatic drive controller cpu 1504d tfMay 12, 2026

  • CVE-2026-41551
    37Monitor

    A vulnerability has been identified in ROS# (All versions < V2.2.2).

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    siemens · ros#May 12, 2026

  • CVE-2025-40949
    35Monitor

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE

    HighCVSS 8.9No exploitEPSS 0%

    siemens · ruggedcom rox mx5000 firmwareMay 12, 2026

  • CVE-2026-22924
    35Monitor

    A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0).

    HighCVSS 8.8No exploitEPSS 0%

    siemens · simatic cn 4100 firmwareMay 12, 2026

  • CVE-2025-40833
    34Monitor

    The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests.

    HighCVSS 8.7No exploitEPSS 0%

    siemens · ie/pb link haMay 12, 2026

  • CVE-2026-22925
    34Monitor

    A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0).

    HighCVSS 8.7No exploitEPSS 0%

    siemens · simatic cn 4100 firmwareMay 12, 2026

  • CVE-2026-33862
    34Monitor

    A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcente

    HighCVSS 8.5No exploitEPSS 0%

    siemens · teamcenterMay 12, 2026

  • CVE-2026-33893
    34Monitor

    A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcente

    HighCVSS 8.7No exploitEPSS 0%

    siemens · teamcenterMay 12, 2026

  • CVE-2025-40947
    30Monitor

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE

    HighCVSS 7.7No exploitEPSS 0%

    siemens · ruggedcom rox mx5000 firmwareMay 12, 2026

  • CVE-2026-44411
    29Monitor

    A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5).

    HighCVSS 7.3No exploitEPSS 0%

    siemens · solid edge se2026May 12, 2026

  • CVE-2026-44412
    29Monitor

    A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5).

    HighCVSS 7.3No exploitEPSS 0%

    siemens · solid edge se2026May 12, 2026

+6 moreAll records of the vendor

Schneider Electric · May 12

3 · 0 KEV · 0 critical
  • CVE-2026-4827
    34Monitor

    Insufficient Entropy vulnerability on Multiple Products

    HighCVSS 8.7No exploitEPSS 0%

    schneider electric · easergy micom c264May 12, 2026

  • CVE-2026-6866
    32Monitor

    Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server

    HighCVSS 8.2No exploitEPSS 0%

    schneider-electric · ecostruxure panel server pas400 firmwareMay 12, 2026

  • CVE-2026-6865
    28Monitor

    Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products

    HighCVSS 7.1No exploitEPSS 0%

    schneider electric · easylogic t150 (formerly saitel dr) remote terminal unit & controllerMay 12, 2026

All records of the vendor