Microsoft Patches 138 Vulnerabilities

| 2026-05-13 10:36 CRITICAL HIGH

JSON

Executive Summary AI-generated

The patch wave is gaining momentum, with Microsoft on pace to break its annual vulnerability record. The company has already patched over 500 vulnerabilities this year alone, including a critical flaw in Windows Netlogon and another in the DNS Client. This trend suggests that AI-driven vulnerability discovery will continue to scale, making it increasingly difficult for organizations to stay ahead of threats. As researchers like Tom Gallagher at Microsoft's Security Response Center note, "The findings in this Patch Tuesday and the retrospective recall on five years of CLFS MSRC cases are evidence that AI vulnerability findings can scale." This implies that companies must be prepared to adapt their patching strategies as new vulnerabilities emerge.

Technical Mitigations AI-generated

* Implement a robust vulnerability scanning and monitoring system: Utilize AI-driven tools to continuously scan for vulnerabilities across the organization's software, hardware, and infrastructure. This can help identify potential security threats before they become actual issues. * Develop an incident response plan that leverages AI-powered threat detection: Create a comprehensive plan that incorporates AI-assisted threat detection, rapid analysis of incidents, and swift action to mitigate damage. This will enable the organization to respond effectively to emerging threats in real-time. * Regularly update software with known vulnerabilities patched: Ensure all critical software updates are applied promptly, even if they don't have any human researcher identifying them first. AI-powered tools can help identify potential issues before they become actual problems. * Implement a secure coding practice that encourages responsible AI development: Foster an environment where developers feel comfortable contributing to security research and testing without fear of retribution or negative consequences. This will encourage the use of AI-driven vulnerability detection in software development. * Develop a culture of continuous learning and improvement: Encourage employees to stay up-to-date with emerging threats, vulnerabilities, and best practices through regular training sessions, workshops, and online resources. This will help ensure that security measures are always aligned with industry standards and best practices.

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

Shai-Hulud CVE-2026-32177 CVE-2026-41095 CVE-2026-41097 CVE-2026-35420 CVE-2026-34331 CVE-2026-35433 CVE-2026-35422 CVE-2026-32204 CVE-2026-32209 CVE-2026-40369 CVE-2026-34345 CVE-2026-40406 CVE-2026-33834 CVE-2026-33837 CVE-2026-40357 CVE-2026-41611 CVE-2026-41109 CVE-2026-32161 CVE-2026-33844 CVE-2026-33840 CVE-2026-40403 CVE-2026-26164 CVE-2026-34350 CVE-2026-35423 CVE-2026-40381 CVE-2026-34347 CVE-2026-35415 CVE-2026-41100 CVE-2026-42826 CVE-2026-40374 CVE-2025-54518 CVE-2026-33835 CVE-2026-40358 CVE-2026-40379 CVE-2026-35417 CVE-2026-40413 CVE-2026-34340 CVE-2026-21530 CVE-2026-35438 CVE-2026-40401 CVE-2026-40363 CVE-2026-40415 CVE-2026-40377 CVE-2026-33841 CVE-2026-40368 CVE-2026-34334 CVE-2026-34336 CVE-2026-42825 CVE-2026-40362 CVE-2026-42832 CVE-2026-40361 CVE-2026-35419 CVE-2026-40370 CVE-2026-34341 CVE-2026-42898 CVE-2026-33109 CVE-2026-35421 CVE-2026-41094 CVE-2026-33117 CVE-2026-33112 CVE-2026-42899 CVE-2026-42896 CVE-2026-34330 CVE-2026-41612 CVE-2026-41102 CVE-2026-42833 CVE-2026-40410 CVE-2026-34344 CVE-2026-40366 CVE-2026-40397 CVE-2026-40365 CVE-2026-35416 CVE-2026-40360 CVE-2026-40402 CVE-2026-33839 CVE-2026-34343 CVE-2026-40417 CVE-2026-40418 CVE-2026-32185 CVE-2026-35418 CVE-2026-40398 CVE-2026-34332 CVE-2026-40408 CVE-2026-32170 CVE-2026-35440 CVE-2026-40464 CVE-2026-40364 CVE-2026-34351 CVE-2026-35436 CVE-2026-42823 CVE-2026-35439 CVE-2026-33833 CVE-2026-34342 CVE-2026-41089 CVE-2026-40382 CVE-2026-33823 CVE-2026-41101 CVE-2026-40380 CVE-2026-35424 CVE-2026-41613 CVE-2026-42893 CVE-2026-40367 CVE-2026-32175 CVE-2026-34329 CVE-2026-34337 CVE-2026-42831 CVE-2026-41088 CVE-2026-35428 CVE-2026-41614 CVE-2026-40405 CVE-2026-40399 CVE-2026-34339 CVE-2026-40421 CVE-2026-41610 CVE-2026-40419 CVE-2026-41086 CVE-2026-41096 CVE-2026-40420 CVE-2026-40414 CVE-2026-40359 CVE-2026-33110 CVE-2026-42830 CVE-2026-40407 CVE-2026-34333 CVE-2026-41103 CVE-2026-34338 CVE-2026-33838

Target & Sectors

NORTH_AMERICA

Incident Timeline

‎November 2025

Threat actors exploited a previously unknown vulnerability in Microsoft's Windows operating system to gain unauthorized access.

‎2026/04/13

Threat actors used AI-assisted vulnerability discovery to target organizations.

Click on any entity below to view its context and source!

organisation National Cyber Security Centre

Patch wave grows It comes as Britain’s National Cyber Security Centre warned last month that organizations should prepare for a surge of urgent software updates driven by AI-assisted vulnerability discovery.

TheRecord

‎2026/05/13

Microsoft released patches for 138 security vulnerabilities across its product portfolio.

Click on any entity below to view its context and source!

organisation CPU

It relates to a case of improper isolation of shared resources within the CPU operation cache on Zen 2-based products that could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

The Hacker News

organisation CVE-2025-54518

Core Tampering Vulnerability Important AMD CPU Branch CVE-2025-54518 AMD: CVE-2025-54518 CPU OP Cache Corruption Important ASP.NET Core CVE-2026-42899 ASP.NET Core Denial of Service Vulnerability Important Azure Connected Machine Agent CVE-2026-40381 Azure Connected Machine Agent Elevation of Privilege Vulnerability Important Azure Logic Apps CVE-2026-42823 Azure Logic Apps Elevation of Privilege Vulnerability Important Azure Machine Learning CVE-2026-33833 Azure Machine Learning Notebook Spoofing Vulnerability Important Azure Monitor Agent CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability Important Azure Monitor Agent CVE-2026-42830 Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability Important Azure SDK CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability Important Data Deduplication CVE-2026-41095 Data Deduplication Elevation of Privilege Vulnerability Important Dynamics Business Central CVE-2026-40417 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability Important GitHub Copilot and Visual Studio CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability Important M365 Copilot CVE-2026-41100

Suggestions