# KB5087545: May 2026 cumulative update for Windows Server 23H2 KB5087545, released May 12, 2026, fixes 58 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/microsoft/kb5087545 - Platform: Microsoft - Released: May 12, 2026 - Priority: Urgent (Closes CVE-2026-41089, rated Critical) - CVEs: 58, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.microsoft.com/help/5087545 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2022](https://patchblox.com/security/data/product/microsoft/windows-server-2022.md) | | 20348.5139 | | [Windows Server 2022 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2022-server-core-installation.md) | | 20348.5139 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-41089](https://patchblox.com/security/data/cve/CVE-2026-41089.md) | Urgent | Windows Netlogon | 9.8 | 0.7962 | | | [CVE-2026-40398](https://patchblox.com/security/data/cve/CVE-2026-40398.md) | Urgent | Windows Remote Desktop | 7.8 | 0.0267 | More likely | | [CVE-2026-33835](https://patchblox.com/security/data/cve/CVE-2026-33835.md) | Urgent | Windows Cloud Files Mini Filter Driver | 7.8 | 0.0212 | More likely | | [CVE-2026-33837](https://patchblox.com/security/data/cve/CVE-2026-33837.md) | Urgent | Windows TCP/IP | 7.8 | 0.0184 | More likely | | [CVE-2026-35416](https://patchblox.com/security/data/cve/CVE-2026-35416.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0165 | More likely | | [CVE-2026-35421](https://patchblox.com/security/data/cve/CVE-2026-35421.md) | Urgent | Windows GDI | 7.8 | 0.0053 | | | [CVE-2026-40403](https://patchblox.com/security/data/cve/CVE-2026-40403.md) | Urgent | Windows Win32K - GRFX | 8.8 | 0.0043 | | | [CVE-2026-35417](https://patchblox.com/security/data/cve/CVE-2026-35417.md) | Urgent | Windows Win32K - ICOMP | 7.8 | 0.0035 | More likely | | [CVE-2026-40402](https://patchblox.com/security/data/cve/CVE-2026-40402.md) | Urgent | Windows Hyper-V | 9.3 | 0.0033 | | | [CVE-2026-33841](https://patchblox.com/security/data/cve/CVE-2026-33841.md) | Urgent | Windows Kernel | 7.8 | 0.0031 | More likely | | [CVE-2026-32161](https://patchblox.com/security/data/cve/CVE-2026-32161.md) | Urgent | Windows Native WiFi Miniport Driver | 7.5 | 0.0030 | | | [CVE-2026-40397](https://patchblox.com/security/data/cve/CVE-2026-40397.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.0027 | More likely | | [CVE-2026-35424](https://patchblox.com/security/data/cve/CVE-2026-35424.md) | High | Windows Internet Key Exchange (IKE) Protocol | 7.5 | 0.0119 | | | [CVE-2026-40406](https://patchblox.com/security/data/cve/CVE-2026-40406.md) | High | Windows TCP/IP | 7.5 | 0.0093 | | | [CVE-2026-40415](https://patchblox.com/security/data/cve/CVE-2026-40415.md) | High | Windows TCP/IP | 8.1 | 0.0079 | | | [CVE-2026-40414](https://patchblox.com/security/data/cve/CVE-2026-40414.md) | High | Windows TCP/IP | 7.4 | 0.0053 | | | [CVE-2026-34329](https://patchblox.com/security/data/cve/CVE-2026-34329.md) | High | Windows Message Queuing | 8.8 | 0.0046 | | | [CVE-2026-40413](https://patchblox.com/security/data/cve/CVE-2026-40413.md) | High | Windows TCP/IP | 7.4 | 0.0040 | | | [CVE-2026-33838](https://patchblox.com/security/data/cve/CVE-2026-33838.md) | High | Windows Message Queuing | 7.8 | 0.0040 | | | [CVE-2026-35415](https://patchblox.com/security/data/cve/CVE-2026-35415.md) | High | Windows Storage Spaces Controller | 7.8 | 0.0033 | | | [CVE-2026-41095](https://patchblox.com/security/data/cve/CVE-2026-41095.md) | High | Data Deduplication | 7.8 | 0.0033 | | | [CVE-2026-40401](https://patchblox.com/security/data/cve/CVE-2026-40401.md) | High | Windows TCP/IP | 7.1 | 0.0033 | | | [CVE-2026-40399](https://patchblox.com/security/data/cve/CVE-2026-40399.md) | High | Windows TCP/IP | 7.8 | 0.0033 | | | [CVE-2026-34343](https://patchblox.com/security/data/cve/CVE-2026-34343.md) | High | Windows Application Identity (AppID) Subsystem | 7.8 | 0.0033 | | | [CVE-2026-35420](https://patchblox.com/security/data/cve/CVE-2026-35420.md) | High | Windows Kernel | 7.8 | 0.0032 | | | [CVE-2026-41088](https://patchblox.com/security/data/cve/CVE-2026-41088.md) | High | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0032 | | | [CVE-2026-34344](https://patchblox.com/security/data/cve/CVE-2026-34344.md) | High | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0031 | | | [CVE-2026-34330](https://patchblox.com/security/data/cve/CVE-2026-34330.md) | High | Windows Win32K - GRFX | 7.8 | 0.0030 | | | [CVE-2026-40377](https://patchblox.com/security/data/cve/CVE-2026-40377.md) | High | Windows Cryptographic Services | 7.8 | 0.0030 | | | [CVE-2026-40407](https://patchblox.com/security/data/cve/CVE-2026-40407.md) | High | Windows Common Log File System Driver | 7.8 | 0.0030 | | | [CVE-2026-34333](https://patchblox.com/security/data/cve/CVE-2026-34333.md) | High | Windows Win32K - GRFX | 7.8 | 0.0030 | | | [CVE-2026-40408](https://patchblox.com/security/data/cve/CVE-2026-40408.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0030 | | | [CVE-2026-34342](https://patchblox.com/security/data/cve/CVE-2026-34342.md) | High | Windows Print Spooler Components | 7.0 | 0.0029 | | | [CVE-2025-54518](https://patchblox.com/security/data/cve/CVE-2025-54518.md) | High | AMD CPU Branch | 7.8 | 0.0029 | | | [CVE-2026-33834](https://patchblox.com/security/data/cve/CVE-2026-33834.md) | High | Windows Event Logging Service | 7.8 | 0.0027 | | | [CVE-2026-34347](https://patchblox.com/security/data/cve/CVE-2026-34347.md) | High | Windows Win32K - GRFX | 7.0 | 0.0026 | | | [CVE-2026-34338](https://patchblox.com/security/data/cve/CVE-2026-34338.md) | High | Windows Telephony Service | 7.8 | 0.0025 | | | [CVE-2026-40382](https://patchblox.com/security/data/cve/CVE-2026-40382.md) | High | Windows Telephony Service | 7.8 | 0.0025 | | | [CVE-2026-34336](https://patchblox.com/security/data/cve/CVE-2026-34336.md) | High | Windows DWM Core Library | 7.8 | 0.0025 | | | [CVE-2026-40410](https://patchblox.com/security/data/cve/CVE-2026-40410.md) | High | Windows SMB Client | 7.0 | 0.0024 | | | [CVE-2026-42825](https://patchblox.com/security/data/cve/CVE-2026-42825.md) | High | Windows Telephony Service | 7.0 | 0.0023 | | | [CVE-2026-34340](https://patchblox.com/security/data/cve/CVE-2026-34340.md) | High | Windows Projected File System | 7.0 | 0.0021 | | | [CVE-2026-34351](https://patchblox.com/security/data/cve/CVE-2026-34351.md) | High | Windows TCP/IP | 7.8 | 0.0021 | | | [CVE-2026-34345](https://patchblox.com/security/data/cve/CVE-2026-34345.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0020 | | | [CVE-2026-35418](https://patchblox.com/security/data/cve/CVE-2026-35418.md) | High | Windows Cloud Files Mini Filter Driver | 7.8 | 0.0020 | | | [CVE-2026-34341](https://patchblox.com/security/data/cve/CVE-2026-34341.md) | High | Windows Link-Layer Discovery Protocol (LLDP) | 7.0 | 0.0020 | | | [CVE-2026-33839](https://patchblox.com/security/data/cve/CVE-2026-33839.md) | High | Windows Win32K - GRFX | 7.0 | 0.0019 | | | [CVE-2026-34331](https://patchblox.com/security/data/cve/CVE-2026-34331.md) | High | Windows Win32K - GRFX | 7.0 | 0.0019 | | | [CVE-2026-34337](https://patchblox.com/security/data/cve/CVE-2026-34337.md) | High | Windows Cloud Files Mini Filter Driver | 7.8 | 0.0016 | | | [CVE-2026-34334](https://patchblox.com/security/data/cve/CVE-2026-34334.md) | High | Windows TCP/IP | 7.8 | 0.0015 | | | [CVE-2026-41097](https://patchblox.com/security/data/cve/CVE-2026-41097.md) | Routine | Windows Secure Boot | 6.7 | 0.0142 | | | [CVE-2026-35423](https://patchblox.com/security/data/cve/CVE-2026-35423.md) | Routine | Telnet Client | 5.4 | 0.0075 | | | [CVE-2026-35422](https://patchblox.com/security/data/cve/CVE-2026-35422.md) | Routine | Windows TCP/IP | 6.5 | 0.0061 | | | [CVE-2026-40380](https://patchblox.com/security/data/cve/CVE-2026-40380.md) | Routine | Windows Volume Manager Extension Driver | 6.2 | 0.0046 | | | [CVE-2026-21530](https://patchblox.com/security/data/cve/CVE-2026-21530.md) | Routine | Windows Rich Text Edit | 6.7 | 0.0032 | | | [CVE-2026-32170](https://patchblox.com/security/data/cve/CVE-2026-32170.md) | Routine | Windows Rich Text Edit Control | 6.7 | 0.0032 | | | [CVE-2026-34339](https://patchblox.com/security/data/cve/CVE-2026-34339.md) | Routine | Windows LDAP - Lightweight Directory Access Protocol | 5.5 | 0.0029 | | | [CVE-2026-32209](https://patchblox.com/security/data/cve/CVE-2026-32209.md) | Routine | Windows Filtering Platform (WFP) | 4.4 | 0.0020 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo