Patch Tuesday May 2026: DNS and Netlogon RCEs hit 9.8, Hyper-V guest escape, plus 2 Dynamics 9.9s

PATCH TUESDAY · MAY 2026

Microsoft dropped a brutal May cycle: unauthenticated RCE in both Windows DNS and Netlogon, each scoring CVSS 9.8. If you manage domain controllers, those two are your top priority tonight. Beyond the Microsoft pile, Fortinet has a 9.8 on FortiSandbox, and there are 17 more across Hyper-V, Azure, Dynamics, and third-party libraries worth reading through before you plan your weekend.

An integer overflow in PgBouncer's network packet parser lets a remote attacker send a crafted packet that could crash the connection pooler or potentially corrupt memory. PgBouncer typically sits in front of PostgreSQL and handles every client connection, so a crash here takes your database offline for every app behind it.

Affects: Anyone running PgBouncer 1.25.1-1 on Azure Linux 3.0

NVD MSRC Ref 1

A race condition in the Xen 9pfs frontend driver lets a local attacker with access to a Xen guest trigger a use-after-free by calling the cleanup function concurrently. This can lead to privilege escalation or a guest-to-host escape on Xen-based virtualization setups. If you're not running Xen paravirtualized guests with 9pfs shares, you're not exposed.

Affects: Anyone running Azure Linux 3.0 kernel 6.6.138.1-1 on Xen-based hypervisors with 9pfs enabled

NVD MSRC

Prometheus exposes Azure AD OAuth client secrets through its configuration API. Anyone who can query that API endpoint can grab the secret and use it to authenticate as the Prometheus service account against Azure AD. If your Prometheus config API is reachable by untrusted users or exposed to the network, treat the affected client secrets as compromised.

Affects: Anyone running Telegraf 1.31.0-19 on Azure Linux 3.0 or Prometheus 2.37.9-7 on CBL Mariner 2.0 with Azure AD remote write configured

NVD MSRC

XML::LibXML for Perl reads beyond allocated heap memory when it encounters XML node names with truncated UTF-8 sequences. An attacker who can feed crafted XML to a Perl application using this library could crash the process or potentially leak heap contents. This matters if you have any Perl services or scripts parsing untrusted XML input.

Affects: Anyone running perl-XML-LibXML 2.0209-2 on Azure Linux 3.0, especially if Perl apps parse untrusted XML

NVD MSRC

Go's net/mail package has a quadratic blowup when parsing comments in email headers. An attacker can send a crafted email header that causes the parser to burn CPU for a very long time, effectively denying service to any Go application that parses mail. This affects Go itself plus anything built with it, including GCC's Go toolchain on the affected systems.

Affects: Anyone running Go 1.25.9-1 or 1.26.2-1 on Azure Linux 3.0, or any Go-based services that parse email headers on those systems

NVD MSRC

SharePoint deserializes untrusted data, letting an authenticated attacker execute arbitrary code on the server over the network. Any user with legitimate SharePoint access can trigger this. If you run on-prem SharePoint, this is a serious RCE that only requires a low-privilege account to pull off.

Affects: Anyone running on-prem Microsoft SharePoint Server

NVD Ref 1

An authenticated attacker can inject and execute arbitrary code on your Dynamics 365 on-prem server over the network. At CVSS 9.9, this is about as bad as it gets for a post-auth bug: one compromised low-privilege account could mean full server takeover. No reports of wild exploitation yet, but the attack surface is wide for anyone running on-prem Dynamics.

Affects: Anyone running Microsoft Dynamics 365 on-premises

NVD Ref 1

An authenticated user in Azure Logic Apps can exploit broken access controls to escalate their privileges over the network. CVSS 9.9 signals near-total impact. If an attacker already has a foothold in your Azure tenant, they could use this to gain control well beyond their assigned role.

Affects: Teams running Azure Logic Apps in any Azure subscription

NVD Ref 1

An unauthenticated attacker can trigger a heap-based buffer overflow in the Windows DNS service and execute code remotely. No credentials needed, no user interaction. CVSS 9.8. If your DNS servers face the network (and they do), this is a top-priority patch.

Affects: Windows sysadmins running the Windows DNS Server role on any supported Windows Server version

NVD Ref 1

An unauthenticated attacker can exploit a stack-based buffer overflow in the Windows Netlogon service to run code remotely. CVSS 9.8 with no auth required. If you remember the Zerologon era, you know how critical Netlogon bugs are: domain controllers are the primary target here.

Affects: Windows sysadmins running Active Directory domain controllers on any supported Windows Server version

NVD Ref 1

A use-after-free bug in Windows Hyper-V lets an unauthenticated local attacker escalate privileges. CVSS 9.3 is unusually high for a local bug, which likely means a guest-to-host escape. If you run Hyper-V, a compromised VM could break out and own the host.

Affects: Anyone running Windows Hyper-V hosts, including Azure Stack HCI and Windows Server virtualization environments

NVD Ref 1

Azure Entra ID (formerly Azure AD) leaks sensitive information to unauthenticated attackers, enabling spoofing over the network. CVSS 9.3. The practical risk: an attacker could impersonate identities or forge tokens in your tenant. This is an identity-plane bug, which makes it dangerous even if your apps are otherwise well-configured.

Affects: Every Azure tenant using Entra ID (which is effectively everyone on Microsoft 365 and Azure)

NVD Ref 1

An authenticated attacker can exploit excessive privileges in Dynamics 365 on-premises to execute code over the network. CVSS 9.1. This is the second critical Dynamics 365 on-prem code execution bug this cycle. A user who should only have read access could run code on your server.

Affects: Anyone running Microsoft Dynamics 365 on-premises

NVD Ref 1

The Microsoft SSO Plugin for Jira and Confluence has a broken authentication implementation that lets an unauthenticated attacker escalate privileges remotely. CVSS 9.1. If you use this plugin to federate Atlassian logins through Microsoft, an attacker could bypass auth entirely and gain elevated access to your Jira or Confluence instance.

Affects: Teams using the Microsoft SSO Plugin for Atlassian Jira or Confluence (on-premises or Data Center)

NVD Ref 1

A broken authentication mechanism in the Azure SDK lets an unauthenticated attacker bypass security features over the network. CVSS 9.1. If your applications use the Azure SDK for auth, an attacker could potentially skip authentication checks entirely. The blast radius depends on what your app protects, but the SDK is everywhere.

Affects: Developers and DevOps teams running applications that use the Azure SDK for authentication

NVD Ref 1

A session fixation bug in Visual Studio Code lets an unauthenticated attacker escalate privileges over the network. CVSS 8.8. Practically, an attacker could fix a session token and trick a developer into using it, then hijack their VS Code session. This likely requires some social engineering or network positioning to pull off.

Affects: Developers using Visual Studio Code

NVD Ref 1