Patch Tuesday, May 2026

Microsoft's monthly security release, Tuesday, May 12, 2026. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

1 CVE · 0 critical · 0 exploited · 0 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← April 2026 June 2026 →Open in the dashboard

Microsoft

1 CVE · 0 critical · 0 exploited · 0 with public exploit code

7.8HighMay 12, 2026Microsoft Windows 11 Version 24H2 Memory corruptionCVE-2026-40369Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.4.7% likely

Adobe

No tracked Adobe CVEs in this window.

SAP

No tracked SAP CVEs in this window.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.