Patch Tuesday May 2026: Microsoft patches a critical zero-click flaw in Outlook and Word.

If you have not patched yet, you are exposed right now.

CVE-2026-40361 — CVSS 9.8 — is a remote code execution vulnerability requiring zero user interaction. No click. No macro. No attachment opened. A crafted email lands in the inbox. Code executes on preview.

• HOW IT WORKS CVE-2026-40361 exploits a memory corruption flaw in the RTF parsing engine shared by Outlook and Word. When a crafted message is displayed in the Reading Pane, the parser processes embedded RTF metadata without proper bounds checking. A heap overflow occurs before the user interacts with anything.

The attacker controls the overflow. They control execution.

The parser is invoked automatically on email receipt. The Reading Pane alone triggers the exploit. No download. No dialog. No decision from the target.

• WHAT IS AT RISK Code executes in the context of the logged-in user. On endpoints where users hold local administrator rights — still widespread across enterprise environments — full system compromise follows immediately. On standard accounts, lateral movement remains viable through credential harvesting or local privilege escalation.
• AFFECTED PRODUCTS — Microsoft Outlook 2016, 2019, 2021, Microsoft 365 — Microsoft Word 2016, 2019, 2021, Microsoft 365 — Windows and macOS clients both affected — Outlook on the Web is not affected — the RTF parser runs client-side
• EXPLOITATION LIKELIHOOD Microsoft assessed CVE-2026-40361 as "Exploitation More Likely" at disclosure. No confirmed in-the-wild exploitation at release. That window closes fast. Zero-click CVEs above CVSS 9.5 historically see weaponized proof-of-concept code within 72 hours of public disclosure.

HOW TO RESPOND NOW

PATCH IMMEDIATELY — Deploy May 2026 Patch Tuesday updates now. This is not routine maintenance. This is incident response cadence.

DISABLE THE READING PANE — Push this as an interim control via Group Policy while patch deployment completes across the fleet.

RESTRICT RTF BY POLICY — Use the FileOpenBlock Group Policy setting to prevent RTF files from opening in Word. Narrows the attack surface while patches propagate.

MONITOR OUTLOOK PROCESS TREES — Alert on Outlook spawning cmd.exe, powershell.exe, or wscript.exe. This behavior is abnormal. Any detection is a high-priority investigation.

PATCH PRIVILEGED ACCOUNTS FIRST — Executives, IT administrators, finance teams. Prime targets for zero-click initial access. Patch them first, confirm, then roll broadly.

Zero-click vulnerabilities generate no trace until it is too late. The only thing an attacker needs from the target is an open email client.

Have you validated Patch Tuesday deployment across your entire Outlook fleet?