Skip to the content
The Update Bureau

Monthly Patch Briefing

May 2026

63 updates released this month .

Updates, page 2

Updates, page 2:
  • Windows 10 · 1607
    Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    KB5087537

    Remote Desktop warnings and Microsoft account sign-in fixed

    Fixes a Remote Desktop warning display issue and a Microsoft account sign-in error, and addresses 44 vulnerabilities, including three Critical ones.

    Build 14393.9140
    Security 44 CVEs 3 critical
    Replaced by KB5094122 →
  • Windows Server · 2025
    Windows Server 2025 Windows Server 2025 Security update
    KB5087539

    Secure Boot certificate rollout expands; ML-DSA signing added

    Secure Boot certificate updates can reach more eligible devices, and certificate authorities can use post-quantum signatures. The update also fixes a Remote Desktop warning dialog that could render incorrectly across monitors.

    Build 26100.32860
    Security 66 CVEs 5 critical
    Known issues 2 open
    Replaced by KB5094125 →
  • Windows Server · 2022
    Windows Server 2022 Windows Server 2022 Security update
    KB5087545

    Critical Netlogon flaw patched; BitLocker recovery risk remains

    Fixes 58 vulnerabilities, including five critical flaws, and addresses a Remote Desktop warning-dialog issue. Some BitLocker configurations might prompt for a recovery key after the first restart.

    Build 20348.5139
    Security 58 CVEs 5 critical
    Known issues 2 open
    Replaced by KB5094128 →
  • Windows Server · 2019
    Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    KB5087538

    Remote Desktop warnings and account sign-in failures fixed

    The update fixes a Remote Desktop security warning display problem and a Microsoft account sign-in failure. It also expands the phased delivery of new Secure Boot certificates.

    Build 17763.8755
    Security 55 CVEs 4 critical
    Replaced by KB5094123 →
  • Windows Server · 2016
    Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    KB5087537

    Four critical remote-code flaws; Secure Boot coverage expands

    Addresses 47 vulnerabilities, including four critical remote-code execution flaws, and expands the devices eligible for Secure Boot certificate updates. It also fixes Remote Desktop warnings and Microsoft-account sign-in problems.

    Build 14393.9140
    Security 47 CVEs 4 critical
    Replaced by KB5094122 →
  • SQL Server · CU4 + GDR
    SQL Server 2025 CU4 + GDR SQL Server 2025 CU4 + GDR Security update
    KB5089899

    Web Service Task security flaw addressed; MSDASQL queries can fail

    Addresses a security flaw in the Web Service Task, but linked-server queries using MSDASQL and a provider string can fail with error 7416.

    Build 17.0.4040.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5101346 →
  • SQL Server · GDR
    SQL Server 2025 GDR SQL Server 2025 GDR Security update
    KB5091223

    Web Service Task flaw addressed; MSDASQL queries can fail

    Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Build 17.0.1115.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102333 →
  • SQL Server · CU24 + GDR
    SQL Server 2022 CU24 + GDR SQL Server 2022 CU24 + GDR Security update
    KB5089900

    Database Engine RCE addressed; provider-string linked queries fail

    Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked-server queries using MSDASQL and a provider string can fail with error 7416.

    Build 16.0.4252.3
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5101347 →
  • SQL Server · GDR
    SQL Server 2022 GDR SQL Server 2022 GDR Security update
    KB5091158

    Web Service Task flaw addressed; linked queries can fail with 7416

    The update addresses one Important SQL Server vulnerability in the Web Service Task. Queries to other servers using the OLE DB Provider for ODBC Drivers might fail with error 7416.

    Build 16.0.1180.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102334 →
  • SQL Server · CU32 + GDR
    SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
    KB5090407

    Web Service Task flaw addressed; linked-server error 7416 remains

    The update addresses a Web Service Task vulnerability that could let an attacker read arbitrary local files or cause a denial-of-service attack. Linked-server queries using MSDASQL can still fail with error 7416.

    Build 15.0.4470.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102335 →
  • SQL Server · GDR
    SQL Server 2019 GDR SQL Server 2019 GDR Security update
    KB5090408

    Remote code execution flaw addressed; MSDASQL queries can fail

    Addresses a SQL Server remote code execution vulnerability. Linked server queries using MSDASQL and a provider string can fail with error 7416.

    Build 15.0.2170.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102336 →
  • SQL Server · CU31 + GDR
    SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
    KB5090354

    Web Service Task flaw could expose files or disrupt service

    Addresses an Important SQL Server remote code execution vulnerability and a Web Service Task XML flaw that could expose local files or cause a denial-of-service. Some linked server queries using MSDASQL still fail with error 7416.

    Build 14.0.3530.2
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102337 →
  • SQL Server · GDR
    SQL Server 2017 GDR SQL Server 2017 GDR Security update
    KB5090347

    Linked-server queries with MSDASQL provider strings fail

    The update addresses an XML external entity flaw in Integration Services. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

    Build 14.0.2110.2
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102338 →
  • SQL Server · SP3 AC + GDR
    SQL Server 2016 SP3 AC + GDR SQL Server 2016 SP3 AC + GDR Security update
    KB5089270

    Web Service Task flaw addressed; linked-server error remains

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416.

    Build 13.0.7085.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102339 →
  • SQL Server · SP3 + GDR
    SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update
    KB5089271

    Web Service Task XML vulnerability addressed; linked queries fail

    The update addresses an XML external entity vulnerability in the Web Service Task. Linked server queries using MSDASQL can still fail with error 7416; Microsoft links to troubleshooting information and workarounds.

    Build 13.0.6490.1
    Security 1 CVE
    Known issues 1 open
    Replaced by KB5102340 →
  • SharePoint Server · SE
    SharePoint Server SE SharePoint Server SE Security update
    KB5002863

    Remote-code flaws addressed; Quick Edit gains keyboard navigation

    Addresses 9 vulnerabilities, including two critical remote-code execution flaws: CVE-2026-40365 in SharePoint Server and CVE-2026-40367 in Word. It also improves Quick Edit keyboard access and fixes farm-management issues.

    Build 16.0.19725.20280
    Security 9 CVEs 2 critical
    Replaced by KB5002873 →
  • SharePoint Server · 2019
    SharePoint Server 2019 SharePoint Server 2019 Security update
    KB5002870

    Two critical code-execution flaws resolved; accessibility improved

    The update resolves 9 vulnerabilities, including two critical remote-code-execution flaws, and fixes accessibility and page-loading problems. Updates for this server version end July 14, 2026.

    Build 16.0.10417.20128
    Security 9 CVEs 2 critical
    Replaced by KB5002874 →
  • SharePoint Server · 2016
    SharePoint Server 2016 SharePoint Server 2016 Security update
    KB5002868

    Critical server code-execution flaw; some pages fail to render

    The update addresses 9 vulnerabilities, including critical remote-code execution flaws in SharePoint Server and Word. It also fixes rendering on some SharePoint pages.

    Build 16.0.5552.1002
    Security 9 CVEs 2 critical
  • Office Online Server OOS Office Online Server Security update
    KB5002871

    Excel code execution and information disclosure flaws fixed

    Resolves three Important Excel vulnerabilities, including remote code execution and information disclosure flaws.

    Build 16.0.10417.20128
    Security 3 CVEs
    Replaced by KB5002875 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows 11 26H1 Security update
    KB5087055

    Two framework flaws could allow higher access

    Addresses two .NET Framework flaws that could let someone gain higher access: CVE-2026-32177 and CVE-2026-35433.

    Build 4.8.9335.0
    Security 2 CVEs
    Replaced by KB5101002 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows 11 25H2 · Windows Server 2025 Security update
    KB5087051

    Two framework flaws could let someone gain higher access

    The update fixes two .NET Framework flaws that could let someone gain higher access. It installs through Windows Update and needs a restart if affected files are in use.

    Builds 4.8.9335.0 2.0.50727.9181
    Security 2 CVEs
    Replaced by KB5100998 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows 11 24H2 Security update
    KB5087054

    Two .NET privilege flaws addressed

    Addresses two Important .NET Framework security flaws. Both could let someone gain higher access than intended.

    Builds 4.8.9334.0 2.0.50727.9181
    Security 2 CVEs
    Replaced by KB5101001 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows 11 23H2 Security update
    KB5087058

    Runtime elevation-of-privilege flaws addressed

    Two .NET Framework elevation-of-privilege vulnerabilities, CVE-2026-32177 and CVE-2026-35433, are addressed. A restart is required if affected files are in use.

    Builds 4.8.9334.0 2.0.50727.9181
    Security 2 CVEs
    Replaced by KB5101004 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows 10 21H2, 22H2 Security update
    KB5087053

    Two .NET runtime elevation-of-privilege flaws addressed

    The update addresses two elevation-of-privilege vulnerabilities in .NET Framework 3.5 and 4.8.1. A restart might be required if affected files are in use.

    Builds 4.8.9334.0 2.0.50727.9181
    Security 2 CVEs
    Replaced by KB5101000 →
  • .NET Framework · 3.5, 4.8.1
    .NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 for Windows Server 2022 Security update
    KB5087059

    Two flaws could give attackers more access

    Addresses two important security flaws in .NET Framework. It applies to Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1 installed.

    Builds 4.8.9334.0 2.0.50727.9181
    Security 2 CVEs
    Replaced by KB5101005 →