Microsoft April 2026 Patch Tuesday: 168 Vulnerabilities, Active Zero-Days, and What You Need to Know

Microsoft’s April 2026 Patch Tuesday is one of the largest releases in recent memory: 168 vulnerabilities across Windows, Office, SharePoint, and Defender — including an actively exploited SharePoint zero-day and a publicly disclosed Defender privilege escalation. Here’s the complete breakdown and your patching order.

The Numbers at a Glance

Microsoft’s April 2026 Patch Tuesday landed as one of the largest releases in recent memory — the second-biggest batch in the company’s history (early tallies reported 167; the final count settled at 168).

• Total CVEs addressed: 168
• Critical severity: 8
• Actively exploited zero-days: 1 (SharePoint)
• Publicly disclosed: 1 (Defender)
• Products affected: Windows, Office, SharePoint, Defender, .NET, Edge

The Critical Zero-Day: CVE-2026-32201 (SharePoint Server)

The most urgent fix in this release targets a spoofing vulnerability in SharePoint Server that is being actively exploited in the wild. Through improper input validation, an unauthenticated attacker can perform spoofing attacks — no user interaction required, low attack complexity. For organizations running internet-facing SharePoint, this can translate into forged identities pivoting into document access and deeper compromise, with lateral movement into Microsoft 365 integrations as the follow-on risk.

Why This Matters

• SharePoint is a prime target — it hosts sensitive documents and collaboration workflows and integrates deeply with Microsoft 365
• Unauthenticated exploitation means no credentials are required
• Active exploitation indicates adversaries are already using this in real attacks
• CISA ordered federal agencies to patch immediately — private sector should treat it the same way

Immediate Actions

1. Patch immediately — apply the SharePoint Server security update
2. Audit internet-facing SharePoint instances — check logs for suspicious activity
3. Restrict network access — limit SharePoint to trusted IP ranges if possible
4. Monitor for exploitation indicators — unusual process execution from SharePoint worker processes

The Emergency RCE: CVE-2026-33824 (Windows IKE Extension)

Buried mid-list but the most severe flaw of the batch: a CVSS 9.8 unauthenticated RCE via a double-free in Windows IKE Service Extensions. No user interaction, low attack complexity — automated exploitation is trivial. Any internet-facing Windows server running IKE/IPsec services should be treated as an emergency patch, ahead of everything else in this release.

The Defender Privilege Escalation Flaw: BlueHammer

A second high-priority fix addresses CVE-2026-33825, a privilege escalation vulnerability in Microsoft Defender — nicknamed “BlueHammer” by the security community. Publicly disclosed (though not exploited at release), it lets a local attacker escalate from standard user to SYSTEM by abusing the signature update process.

Why This Matters

• Defender runs as SYSTEM — the highest privilege level on Windows
• At SYSTEM: disable security tools, install persistence, harvest credentials, move laterally
• Local privilege escalation chains trivially with phishing for full takeover
• Public disclosure means exploit code may surface quickly

Other Critical Vulnerabilities

Microsoft Office RCE (CVSS 8.4)

Three critical RCE flaws (CVE-2026-32190, CVE-2026-33114, CVE-2026-33115) via use-after-free and pointer corruption — delivered through malicious documents, the perennial phishing vector.

Windows Kernel (Multiple CVEs)

Several kernel memory-corruption issues patched — particularly dangerous in multi-user environments and terminal servers.

Remote Desktop Services

RDS received RCE patches. Given its history as an attack vector (remember BlueKeep), prioritize these alongside kernel fixes.

.NET Framework

DoS and RCE fixes — web applications on older .NET versions are especially exposed.

Broader Threat Landscape: April 2026

Microsoft’s Patch Tuesday coincided with a wider surge — the full picture is in our April 2026 threat landscape analysis:

• Adobe Acrobat patched CVE-2026-34621, a critical actively exploited flaw
• Cisco SD-WAN devices under active exploitation — CISA emergency directive issued
• Apache ActiveMQ critical flaw drew a second CISA directive
• Oracle released 481 patches in its quarterly update
• AI infrastructure had its own brutal week — see the CVE-2026 AI stack analysis

WordPress CVEs to Watch This Month

Not part of Microsoft’s release, but relevant to anyone running web properties:

• CVE-2026-5617: Login as User plugin — affects versions up to 1.0.3
• CVE-2026-1492: User Registration & Membership plugin — unauthenticated admin creation, complete site takeover
• Smart Slider 3: arbitrary file read affecting 800,000+ sites, exposing database credentials

Remove unused plugins, update core/themes/plugins, and check specifically for those three. If you’re on shared hosting, also see our cPanel CVE-2026-41940 authentication bypass analysis.

Prioritization Framework

With 168 vulnerabilities to address, here’s how to order the work:

1. Immediate (24–48 hours): CVE-2026-33824 IKE RCE on internet-facing servers, CVE-2026-32201 SharePoint zero-day, BlueHammer on multi-user systems
2. High priority (1 week): Windows kernel, RDS, Office RCE vulnerabilities
3. Standard (2–4 weeks): remaining Windows, .NET, and Edge patches
4. Monitor: all other CVEs — review against your specific environment

Key Takeaways

• April 2026 is a patch super-cycle — 168 CVEs is far above the monthly average
• The SharePoint zero-day (CVE-2026-32201) demands immediate attention from any organization running SharePoint
• The IKE RCE (CVE-2026-33824, CVSS 9.8) outranks everything on internet-facing Windows servers
• WordPress admins have three critical plugin CVEs to check — plus the hosting-layer cPanel flaw
• Automation is key — WSUS, SCCM, or managed patching services are the only sane way through a month like this

FAQ

How many vulnerabilities did Microsoft patch in April 2026?

168 — the second-largest Patch Tuesday in Microsoft’s history. Eight were rated Critical, seven of those enabling remote code execution.

Which CVE was actively exploited in the April 2026 Patch Tuesday?

CVE-2026-32201, a SharePoint Server spoofing vulnerability. Unauthenticated, no user interaction, and CISA ordered federal agencies to patch immediately. CVE-2026-33825 “BlueHammer” (Defender EoP) was publicly disclosed but not exploited at release.

What is CVE-2026-33824?

A CVSS 9.8 unauthenticated remote code execution flaw in Windows IKE Service Extensions caused by a double-free. Low attack complexity, no user interaction — treat any internet-facing Windows server with IKE/IPsec as an emergency patch.

What should I patch first?

Order: CVE-2026-33824 (IKE RCE) on internet-facing servers → CVE-2026-32201 (SharePoint) → BlueHammer (Defender) → Office RCEs → kernel/RDS → the rest over 2–4 weeks.

References

• Microsoft Security Update Guide
• CISA Known Exploited Vulnerabilities Catalog
• Zero Day Initiative — April 2026 Security Update Review
• Hmmnm — April 2026 Cyber Threat Landscape

Last updated: April 29, 2026. Always verify CVE details against official sources before taking action.

Related Reading

Part of our Cyber Threat Intelligence & CVE Analysis: The Complete Guide series.

n

n
• Cyber Threat Intelligence & CVE Analysis: The Complete Guide
• The Zero-Day Surge of 2026: Critical Vulnerabilities Every Defender Must Know
• When the Defender Becomes the Door: Inside the BlueHammer, RedSun, and UnDefend Triple Zero-Day Crisis
• The AI Inversion: 6 Real Incidents That Redefined Cybersecurity in 2026
• Education Sector Cybersecurity Crisis: Canvas Breach and Carmen Shutdown Shake Academia
• Cybersecurity Threat Briefing: Zero-Days, AI Supply Chain Attacks, and Next-Gen Banking Trojans (May 2026)
• Ransomware Evolution 2016-2026: What Defenders Keep Missing