The May 13, 2026 Patch Tuesday marks a turning point in preventive vulnerability discovery. Microsoft fixed 138 vulnerabilities — 30 Critical, 104 Important, 3 Moderate, and 1 Low — and disclosed that 16 of them, in the Windows networking and authentication stack, were identified by the MDASH AI system before attackers could exploit them. None of the 138 were listed as "publicly known" or "under active attack" at the time of release, according to the cited source.
- 16 vulnerabilities in the Windows networking and authentication stack were discovered by the MDASH AI system, short for "multi-model agentic scanning harness" >The total of 138 CVEs patched in May 2026 — 30 Critical, 104 Important, 3 Moderate, 1 Low — is reported by The Hacker News; official Microsoft release notes list 161 CVEs, a broader count that includes multi-product updates
- None of the vulnerabilities were publicly known or under active attack at the time of release, according to the cited source
- Microsoft expects AI-assisted discovery to increase the scale of Patch Tuesday releases in the coming months
MDASH: How the AI That Hunts Flaws in Microsoft Code Works
The MDASH system represents the evolution of an approach partially announced earlier. It is a "multi-model agentic scanning harness" that integrates large language models with automated code-scanning techniques, with particular focus on Windows networking and authentication components. The "agentic" architecture implies the models do not merely classify known patterns but can orchestrate action sequences autonomously.
Tom Gallagher, VP of Engineering at the Microsoft Security Response Center, stated that "a greater share of the issues addressed were discovered by Microsoft, compared to prior months" and that "many of these were surfaced through AI investments and investigations across our engineering and research teams, including the use of Microsoft's new multi-model AI-driven scanning harness." The quote, reported by The Hacker News, does not specify the exact share of internally discovered vulnerabilities versus the total, but confirms a trend of growing internal discovery.
The cited source does not detail the full technical architecture of MDASH. It does not specify which models are employed, on which datasets they were trained, or how human verification of results occurs. It also provides no quantitative comparison with traditional discovery methods. These limits make it impossible to determine whether the same 16 vulnerabilities would have been identified without AI intervention.
The analysis of MDASH is based on The Hacker News report aggregating Microsoft statements, without independent confirmation from other sources.
The Month's Most Severe Vulnerabilities: Four CVEs Above 9.8
Among the 138 fixes, four CVEs stand out with CVSS scores above 9.8, all documented in their respective official Microsoft advisories. CVE-2026-41096 scores 9.8: a heap-based buffer overflow in Windows DNS allowing unauthenticated remote code execution. CVE-2026-42826, with CVSS 10.0, concerns an information disclosure in Azure DevOps; the official Microsoft advisory specifies that "this vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take."
CVE-2026-33109 (CVSS 9.9) highlights an improper access control in Azure Managed Instance for Apache Cassandra leading to RCE. CVE-2026-42898 (CVSS 9.9) documents a code injection in Microsoft Dynamics 365 on-premises, also with potential remote code execution. Full technical details for these last two are available in their respective official advisories.
A numerical discrepancy is worth noting: The Hacker News reports 138 vulnerabilities patched in the core Patch Tuesday, while official Microsoft release notes for May 2026 list 161 CVEs. This broader count includes multi-product updates or other categories not covered in the 138 subset. The severity distributions (30 Critical, 104 Important, etc.) refer to the set of 138 reported by The Hacker News.
"AI-assisted vulnerability discovery is expected to increase the scale of Patch Tuesday releases in the coming months" — Microsoft, reported by The Hacker News
Operational Pressure on IT Administrators
The increased patch volume does not automatically translate to reduced operational risk for organizations. Satnam Narang of Tenable noted that Microsoft has already fixed over 500 CVEs in the first five months of 2026, a pace exceeding previous cycles. More vulnerabilities discovered pre-release mean more fixes to deploy, but also more noise in the triage process.
Gallagher explicitly addressed this problem: "Stay current on supported operating systems, products, and patches, and revisit the speed and consistency of your patching cadence. Triage by exposure and impact, not raw count." The advice reveals a structural tension: AI scales discovery, but organizational deployment capacity remains constrained by maintenance windows, compatibility testing, and resource prioritization.
The problem is especially acute for infrastructures that cannot afford "patch and pray." Without indications of active exploits — and in May 2026 there are none for any of the 138 vulnerabilities — administrators must calibrate effort on purely preventive grounds.
What to Do Now
Per Gallagher's guidance, organizations should keep supported operating systems and products up to date, and reassess the speed and consistency of their patching cadence. Prioritization must be based on exposure and impact, not raw CVE count.
For the four vulnerabilities with CVSS above 9.8, verifying patch coverage is particularly relevant given their documented severity. In the specific case of CVE-2026-42826 (Azure DevOps), Microsoft has already completed mitigation requiring no user action.
The cited source does not document pre-patch in-the-wild exploits for the 16 vulnerabilities discovered by MDASH, nor does it provide differentiated priority guidance for this subset versus the other 122 CVEs.
Frequently Asked Questions
Did MDASH find the vulnerabilities before hackers?
The source does not document that the 16 vulnerabilities were subject to in-the-wild exploits before the patch. MDASH identified them before attackers could exploit them, but it is not possible to determine whether specific hackers were already analyzing them.
Why the numbers 138 and 161?
138 is The Hacker News count for the core Patch Tuesday. 161 is the total from official Microsoft release notes, which includes multi-product updates or other categories not detailed in The Hacker News report.
Do all 138 vulnerabilities require immediate action?
No. None are listed as "publicly known" or "under active attack." Prioritization should follow the exposure and impact criterion indicated by Gallagher, not raw CVE count.
Are the cited sources independent?
No. The analysis is based on a The Hacker News report aggregating official Microsoft statements. No independent source is available confirming MDASH operational details or the timeline of the 16 discoveries.
Information verified against cited sources and current as of publication.
Sources
- https://thehackernews.com/2026/05/microsoft-patches-138-vulnerabilities.html
- https://msrc.microsoft.com/update-guide/releaseNote/2026-May
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42826
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33109
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42898
- https://thehackernews.com/2026/01/microsoft-fixes-114-windows-flaws-in.html
- https://www.theregister.com/2026/04/29/microsoft_zero_click_exploit/