WEEKLY BRIEFING · 18 MAY – 24 MAY 2026 · UTC
Public sources only
58 public updates in week 21
MSRC published 19 new Microsoft CVEs, 14 critical, 2 already exploited in the wild. 22 roadmap changes, led by Teams (9) and Outlook (6). CISA added 6 Microsoft CVEs to its Known Exploited Vulnerabilities catalog. 1 lifecycle milestone fall in the next 30 days. 5 Windows and security articles from Microsoft blogs.
0Windows KB releases
0MSRC release notes
22Roadmap changes across 7 products
5Windows and security articles
19Microsoft CVEs published · 14 critical
6Microsoft CVEs added to CISA KEV
Security to act on8
- CVE-2026-41091 — Microsoft Defender Elevation of Privilege Vulnerabilityexploited
- CVE-2026-45498 — Microsoft Defender Denial of Service Vulnerabilityexploited
- CVE-2026-45659 — Microsoft SharePoint Remote Code Execution VulnerabilityCISA KEV
- CVE-2026-45585 — Windows BitLocker Security Feature Bypass Vulnerabilitydisclosed
- CVE-2010-0806 — Microsoft Internet Explorer Use-After-Free VulnerabilityKEV 20 May
- CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free VulnerabilityKEV 20 May
- CVE-2009-1537 — Microsoft DirectX NULL Byte Overwrite VulnerabilityKEV 20 May
- CVE-2008-4250 — Microsoft Windows Buffer Overflow VulnerabilityKEV 20 May
Windows and security news5
- Announcing new builds for 22 May 202622 May
- Public preview: Expanded coverage and unified management for SQL VA Express Configuration19 May
- Updated Secure Boot status report in Windows Autopatch19 May
- Security Review for Microsoft Edge version 14819 May
- Introducing selective response actions for high-value assets in Microsoft Defender18 May
Lifecycle milestones in the next 30 days1
- End of servicing: Microsoft Configuration Manager, Version 2409 6 Jun
Microsoft product news25
Microsoft Graph changelog · 9
- Reports (beta): Added the identityCorrelation resource. (+11 more)22 May
- Teamwork and communications (beta): Added the isManualApprovalEnabled property to the virtualEventRegistrationConfiguration resource. (+6 more)22 May
- Backup and recovery (v1.0): Added the notificationEventsType enumeration type. (+4 more)22 May
6 more
- Cloud communications (beta): Added the capacity property to the town hall resource. (+1 more)22 May
- Identity and access (beta): Updated the targetedAuthenticationMethod property of the authenticationMethodsRegistrationCampaignIncludeTarget resource to support Fido2 i…21 May
- Devices and app management (beta): Added the iconPathInvalid member to the cloudPcCloudAppActionFailedErrorCode enumeration. (+3 more)20 May
- Device and app management (beta): Removed the troubleshootDetailsReport member from the cloudPCTroubleshootReportType enumeration. (+38 more)20 May
- Device and app management (beta): Added the australiaNewZealand member to the cloudPcGeographicLocationType enumeration.19 May
- Device and app management (beta): Added the cloudPcPool resource and associated methods. (+15 more)19 May
Azure Infrastructure Blog · 4
- Golden Image Refresh for Virtual Machines and VM Scale Sets: Driving Consistency at Scale20 May
- Building AI Guardian Extension: AI Detection and Enterprise AI Security19 May
- Rundeck – AWS Enterprise Rundeck Integration with Azure Runner19 May
PowerShell release notes · 3
- v7.6.2 Release of PowerShell21 May
- v7.5.7 Release of PowerShell21 May
- v7.4.16 Release of PowerShell21 May
Gemini API release notes · 3
- Launched the Managed Agents in the Gemini API in public preview.19 May
- Released gemini-3.5-flash, the generally available (GA) version of Gemini 3.5 Flash, our most intelligent model for sustained frontier performance on agentic and coding…19 May
- Released the general-purpose Antigravity Agent managed agent, antigravity-preview-05-2026, in public preview.19 May
PowerShell Team Blog · 2
- PowerShell is now notarized and hardened for macOS21 May
- PowerShell PSResource Roadmap and Best Practices20 May
OpenAI API changelog · 2
- Released Secure MCP Tunnel for enterprise customers.19 May
- You can now manage multiple IP allowlists and apply each one at the project level or across the whole organization.19 May
Exchange Team Blog · 1
Microsoft Intune what's new · 1
From the community6
- Move data between databases, CSV, and Excel with DbaClientX and PSWriteOffice23 May
- Switching Data Loss Prevention Client-Side Checks for OWA22 May
- Use a SharePoint List to Store Weekly Open Tasks Statistics21 May
- Automating Microsoft 365 with PowerShell June 2026 Update20 May
- SharePoint Online Gets Authoritative Sites19 May
Microsoft 365 roadmap22
Teams · 9
- Microsoft Teams: Book future meetings directly from Teams panels20 May
- Microsoft Teams: Identify bots joining your Teams meetings19 May
- Microsoft Teams: Create custom templates for immersive events in Microsoft Teams18 May
6 more
- Microsoft Teams: Digital signage in Teams Rooms on Android18 May
- Microsoft Teams: Easily find unsent drafts18 May
- Microsoft Teams: Enhanced issue detection in Teams Rooms on Windows and auto-remediation with Teams Rooms Pro Management.18 May
- Microsoft Teams: New Organization chart in the Profile Card for Web and Desktop18 May
- Microsoft Teams: Resizable Gallery in Teams Meetings18 May
- Microsoft Teams: Video recap in Teams18 May
Outlook · 6
- Outlook: Choose to Show Unread or Total Count for Each Folder21 May
- Outlook: Navigate Your Favorite Folders Without Expanding the Folder Pane21 May
- Outlook: Calendar Conditional Formatting in New Outlook20 May
3 more
Microsoft 365 Copilot · 3
- Microsoft CoPilot (Microsoft 365): List email attachments in M365 Copilot19 May
- Microsoft Copilot (Microsoft 365): App Navigation Pane Update18 May
- Microsoft Copilot (Microsoft 365): Work IQ APIs: Researcher Agent Access18 May
Microsoft Edge · 1
3 more products · 3 changes
Purview · 1
SharePoint · 1
Viva · 1
Every line opens its detail page or the original Microsoft source. This briefing uses public sources only and says nothing about your tenant or devices.