Microsoft released May 2026 patches and more - May 17, 2026

Featured

Microsoft Released May 2026 Software Updates

The updates fix 120 security vulnerabilities in total, with no zero-day vulnerabilities disclosed this month.

This Week’s Updates

Breaches

Škoda Auto (Volkswagen Group) discloses a customer data breach after attackers hacked its online shop and stole personal information

Foxconn confirms a cyberattack disrupted operations at its North American factories, which are now restoring normal production

West Pharmaceutical Services discloses a cyberattack that resulted in data exfiltration and system encryption

OpenAI confirms two employee devices were breached in the TanStack npm/PyPI supply-chain attack and is rotating code-signing certificates

Vulnerabilities

SAP ships May 2026 security updates fixing 15 flaws, including two critical vulnerabilities in Commerce Cloud and S/4HANA

Fortinet releases patches for two critical RCE vulnerabilities in FortiSandbox and FortiAuthenticator

A new critical vulnerability in the Exim mail transfer agent allows unauthenticated remote code execution in certain configurations

Linux distributions roll out patches for "Fragnesia" (CVE-2026-46300), a high-severity kernel privilege-escalation flaw allowing root code execution

An 18-year-old NGINX vulnerability is disclosed that enables denial of service and, under certain conditions, remote code execution

Cisco warns CVE-2026-20182, a critical Catalyst SD-WAN Controller authentication bypass, was actively exploited in zero-day attacks granting admin privileges

A critical authentication bypass in the Burst Statistics WordPress plugin is being exploited to gain admin-level access to sites

Two vulnerabilities in the Avada Builder WordPress plugin (~1M installs) allow attackers to read arbitrary files and steal site database credentials

A critical Funnel Builder WordPress plugin vulnerability is being actively exploited to inject credit-card-skimming JavaScript into WooCommerce checkout pages

Threats

"Shai-Hulud" supply-chain attack ships signed malicious npm packages (TanStack, Mistral and others), compromising hundreds of open-source packages