Microsoft April 2026 Patch Tuesday Fixes 168 Vulnerabilities

Microsoft has released its April 2026 Patch Tuesday security update on April 14, 2026, addressing a staggering 168 vulnerabilities, double the number patched in March 2026, including one actively exploited zero-day.

One publicly disclosed zero-day, and eight Critical-rated flaws spanning Windows core components, Microsoft Office, Active Directory, and developer tools.

Security teams across enterprises must treat this month’s release with urgency. The sheer volume of patches, combined with an in-the-wild zero-day targeting SharePoint Server and Critical remote code execution flaws in Windows TCP/IP and Active Directory, makes April 2026’s Patch Tuesday one of the most consequential releases of the year.

Actively Exploited Zero-Day: SharePoint Spoofing Flaw

The single most dangerous vulnerability patched this month is CVE-2026-32201, a Microsoft SharePoint Server Spoofing Vulnerability that has been actively exploited in the wild.

Attackers have already leveraged this flaw to conduct spoofing attacks against enterprise SharePoint environments used for document management and internal collaboration.

Rated Important, the vulnerability poses a critical risk to organizations that rely on SharePoint for daily operations and warrants CISA-level urgency; security administrators should deploy this patch immediately, without waiting for scheduled maintenance windows.

Additionally, CVE-2026-33825, a Microsoft Defender Elevation of Privilege Vulnerability rated Important with a CVSS score of 7.8, was publicly disclosed before a patch was available.

This flaw exploits an insufficient granularity of access control weakness (CWE-1220) in Microsoft Defender, allowing a low-privileged local attacker to escalate to SYSTEM-level privileges with no user interaction required.

It is widely presumed to be linked to the “BlueHammer” exploit released publicly on April 2, 2026. Proof-of-concept exploit code exists in the wild, and Microsoft assesses exploitation as more likely.

Critical Windows TCP/IP and Active Directory RCEs

Among the eight Critical vulnerabilities this month, two stand out as network-level threats requiring no user interaction:

• CVE-2026-33827 – Windows TCP/IP Remote Code Execution vulnerability rated Critical. A remote attacker could exploit this flaw at the network layer, making it a wormable-class candidate that could propagate across unpatched infrastructure.
• CVE-2026-33826, the Windows Active Directory Remote Code Execution vulnerability, is also rated Critical. Active Directory is the identity backbone of most enterprise environments, and a successful exploit here could grant attackers full domain-level access, enabling lateral movement, credential theft, and complete network takeover.
• CVE-2026-33824 – Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution vulnerability rated Critical, targeting VPN and IPSec infrastructure that enterprises rely on for secure remote access.

Critical Microsoft Office and Word Exploits

Three Critical remote code execution vulnerabilities affect Microsoft Office and Word, all carrying a CVSS score of 8,4 and they require no authentication, making them highly attractive for phishing-based campaigns:

• CVE-2026-33115 – Microsoft Word RCE via a use-after-free memory flaw; exploitation can be triggered through the document preview pane, meaning a user doesn’t even need to open a malicious file.
• CVE-2026-33114 – Microsoft Word RCE via an untrusted pointer dereference flaw; a specially crafted Word document sent via email or Teams can trigger arbitrary code execution.
• CVE-2026-23666 – .NET Framework Denial of Service vulnerability rated Critical, affecting all applications built on the .NET runtime stack,ck including enterprise web applications and backend services.

Broad Attack Surface: Elevation of Privilege Dominates

The full breakdown of April 2026’s 168 CVEs reveals an overwhelming concentration of Elevation of Privilege (EoP) vulnerabilities, totaling 93, more than half of the entire patch batch:

The massive EoP count reflects attackers’ increasing focus on post-exploitation privilege escalation: gaining initial access via phishing or RCE, then using EoP to escalate to SYSTEM or domain admin rights.

Notable EoP targets include the Windows Kernel (CVE-2026-26179, CVE-2026-26180, CVE-2026-26163), Windows Kerberos (CVE-2026-27912), PowerShell (CVE-2026-26170), Windows Installer (CVE-2026-27910), and multiple Windows Shell instances (CVE-2026-27918, CVE-2026-26165, CVE-2026-26166).

Developer Tools, Open Source & Third-Party CVEs

This month’s release also covers third-party and open-source components shipped with Microsoft products, including:

• CVE-2026-32631 – Git for Windows NTLM hash leak during git clone from manipulated repositories, rated Important
• CVE-2026-34743 – XZ Utils buffer overflow in lzma_index_append(), affecting Microsoft Mariner Linux
• CVE-2026-31789 – OpenSSL heap buffer overflow in hexadecimal conversion
• CVE-2026-28390/28389/28388 – Three OpenSSL NULL dereference vulnerabilities in CMS message processing
• CVE-2026-3783/3784 – Dual curl vulnerabilities: token leak with redirect/netrc and wrong proxy connection reuse with credentials
• CVE-2026-23653 – GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Complete CVE Table April 2026 Patch Tuesday

Recommended Immediate Actions

Security teams should prioritize patches in the following order:

• Immediately: Patch CVE-2026-32201 (SharePoint zero-day actively exploited); patch CVE-2026-33825 (Defender EoP with PoC exploit)
• Within 24–48 hours: Apply Critical patches for CVE-2026-33827 (TCP/IP RCE), CVE-2026-33826 (Active Directory RCE), CVE-2026-33824 (IKE RCE), and all Critical Word/Office RCEs
• Within 7 days: Deploy all remaining Important and Moderate patches, with focus on Kerberos, BitLocker, Windows Hello, and WSUS tampering vulnerabilities
• For DevOps/DevSec teams: Update Git for Windows (CVE-2026-32631), curl, OpenSSL, and XZ Utils components immediately.

Frequently Asked Questions (FAQ)

Q1: What is the most critical vulnerability in Microsoft’s April 2026 Patch Tuesday?
CVE-2026-32201, an actively exploited SharePoint Server Spoofing zero-day, and CVE-2026-33827, a Critical Windows TCP/IP RCE, are the top priorities requiring immediate patching.

Q2: Is there a zero-day vulnerability under active exploitation in April 2026?
Yes, CVE-2026-32201 (SharePoint spoofing) has been confirmed exploited in the wild, and CVE-2026-33825 (Defender EoP) was publicly disclosed with PoC code available before the patch.

Q3: How many vulnerabilities did Microsoft patch in April 2026’s Patch Tuesday?
Microsoft addressed 168 vulnerabilities in total, double the March 2026 count, including 8 Critical, 1 actively exploited zero-day, and 93 Elevation of Privilege flaws.

Q4: Which Microsoft products are most impacted by the April 2026 security updates?
Windows OS components (TCP/IP, Active Directory, Kernel, Kerberos), Microsoft Office/Word, SharePoint Server, .NET Framework, and developer tools, including GitHub Copilot and Visual Studio Code.

Site: http://thecybrdef.com

About the Author

John

Author

John is an independent cybersecurity researcher covering vulnerabilities, malware campaigns, and emerging threats in the cybersecurity landscape.

Visit Website View All Posts