Microsoft MDASH publishes 15-CVE Windows networking cohort

Source status: Microsoft's May 12 Security Blog directly names MDASH and lists a 16-CVE Patch Tuesday cohort. This page carries 15; CVE-2026-33096 has a separate shared page because MSRC also credits Claude.

Summary

Microsoft’s May 12, 2026 Security Blog post enumerates a 16-CVE cohort found using codename MDASH. This page contains 15 of those identifiers across tcpip.sys, ikeext.dll, netlogon.dll, dnsapi.dll, http.sys, and telnet.exe. CVE-2026-33096 is represented separately because its MSRC record also credits a Calif/Claude-assisted report.

The highest-impact items in Microsoft’s table are four Critical remote code execution flaws:

CVE-2026-33827, a remote unauthenticated use-after-free in tcpip.sys via IPv4 Strict Source and Record Route processing.
CVE-2026-33824, an unauthenticated IKEv2 double-free in ikeext.dll that can lead to LocalSystem remote code execution.
CVE-2026-41089, a stack buffer overflow in Windows Netlogon.
CVE-2026-41096, a heap out-of-bounds issue in the Windows DNS client.

The remaining CVEs cover denial of service, information disclosure, security feature bypass, elevation of privilege, and one additional Important remote code execution issue across Windows network-adjacent components.

Attribution

This is a direct-attribution entry. The primary source is Microsoft itself: the Security Blog post names codename MDASH, describes the scanning harness, lists the 16 CVEs in the Patch Tuesday cohort, and includes technical deep dives for CVE-2026-33827 and CVE-2026-33824.

The MSRC release and CVE pages are linked as corroborating public advisory records. They are not needed for the AI attribution; they confirm that the listed vulnerabilities were shipped as public security updates.

Why it matters

This is the strongest Microsoft-side bugflation signal so far. It is not a single assisted review or a retrospective benchmark: Microsoft says an internal AI vulnerability-discovery system fed directly into a monthly security release for Windows networking and authentication components.

The important operational signal is the combination of volume, target quality, and validation. Windows networking code is a mature, high-value target, and the published cohort includes remotely reachable Critical bugs where false positives would be expensive to triage.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.