Microsoft’s May 2026 Patch Tuesday disclosed seven critical-severity vulnerabilities across Azure Linux 3.0 packages, all rooted in upstream Go cryptography and networking library defects (golang.org/x/crypto and golang.org/x/net). The affected packages — docker-buildx and cert-manager — sit at the center of Azure Kubernetes Service build and certificate automation pipelines, making exploitation relevant to any organization running containerized workloads on AKS or Azure Linux 3.0. Vulnerability classes span authentication bypass (CVSS 10.0), hostname validation bypass (CVSS 10.0), memory corruption with RCE potential (CVSS 9.8), SSH key constraint stripping, FIDO/U2F physical presence bypass, and denial-of-service via deadlock and infinite loop.