Patch Tuesday May 2026 — 4 Fixes That Matter to Every UK Small Business
May 2026 Patch Tuesday: Four Critical Bugs and a Five-Step Deployment Plan Graham Falkner walks through Microsoft’s May 2026 Patch Tuesday release: 137 CVEs, 30 rated critical, and for the first time since June 2024, no active zero-days. He covers the four vulnerabilities that matter for UK small businesses in priority order. CVE-2026-41089, a wormable Netlogon buffer overflow with a CVSS score of 9.8, requires domain controller patching within 48 hours. CVE-2026-41096 in the Windows DNS Client affects every endpoint. CVE-2026-42898 in on-premises Dynamics 365 and CVE-2026-41103 in the Microsoft SSO plugin for Atlassian products both demand immediate attention. Graham explains a documented BitLocker recovery key prompt affecting specific configurations, provides a five-step deployment plan with exact KB numbers, and reminds listeners that Adobe, SAP, AMD, and Apple also shipped fixes the same day. No hype, no exaggeration. Just the patches that matter, the time they take, and what to ignore. Chapters Cold Open Graham introduces May 2026’s Patch Tuesday: 137 CVEs, 30 critical, and no zero-days for the first time since June 2024. He outlines the four bugs that matter for UK small businesses and promises priority order, KB numbers, and realistic timescales. Shape of the Release CVE counts vary by source due to inclusion of Azure, Mariner, and other components. Microsoft’s AI-driven MDASH harness found 16 vulnerabilities this month. Tenable analysis suggests Microsoft is on pace to break the 2020 record of 1,245 CVEs in a calendar year. Bug One: Netlogon CVE-2026-41089 is a stack-based buffer overflow in Windows Netlogon with a CVSS score of 9.8. It is unauthenticated, remote, and wormable. A compromised domain controller grants full Active Directory access. On-premises domain controllers must be patched within 48 hours. Bug Two: Windows DNS Client CVE-2026-41096 is a heap-based buffer overflow in the Windows DNS Client, CVSS 9.8, requiring no authentication or user interaction. An attacker controlling DNS responses can achieve remote code execution. Every Windows endpoint needs patching. Bugs Three and Four: Dynamics 365 and Atlassian SSO CVE-2026-42898 affects on-premises Dynamics 365 (CVSS 9.9). CVE-2026-41103 affects the Microsoft SSO plugin for Atlassian Jira and Confluence, rated exploitation more likely. Plugin updates must be verified separately with Atlassian. The Bug You Can Ignore CVE-2026-42826 in Azure DevOps scored a perfect CVSS 10.0 but has already been fully mitigated by Microsoft. No customer action is required. It exists for transparency only. The BitLocker Known Issue Specific configurations combining BitLocker, PCR7 validation, and the Windows UEFI CA 2023 certificate may prompt for a recovery key on first restart. Graham provides a three-step GPO workaround and emphasises the importance of backing up recovery keys before deployment. The Five-Step Deployment Plan Graham sets out a prioritised patching plan: domain controllers within 48 hours, test ring deployment tomorrow, full endpoint rollout by Friday, separate Atlassian plugin updates, and an audit of any backlog older than three months. He provides exact KB numbers for each Windows version. Beyond Microsoft Adobe released 32 patches, SAP disclosed 15 vulnerabilities including two critical, AMD addressed a Zen 2 processor bug, and Apple updated macOS, iOS, and other platforms. Mac fleets and SAP or Adobe estates need patching too. Wrap-Up Graham recaps the week’s priorities, directs listeners to the companion blog post for KB numbers and source links, and reminds them that patching a domain controller takes an hour, not a week. Links https://msrc.microsoft.com/update-guide/ https://www.theregister.com/ https://www.scmagazine.com/ https://www.bleepingcomputer.com/ https://www.tenable.com/ https://www.zerodayinitiative.com/ https://www.cyberdaily.com/ https://action1.com/ https://isc.sans.edu/