Microsoft Patch Tuesday — April 2026: 168 Vulnerabilities Fixed, Including an Actively Exploited SharePoint Zero-Day

Microsoft’s April 2026 Patch Tuesday delivers a heavy set of fixes: 168 vulnerabilities across Windows, Office, Azure components and developer tools. The release includes one confirmed actively exploited zero-day in SharePoint Server (CVE-2026-32201) and a publicly disclosed elevation-of-privilege flaw in Microsoft Defender (CVE-2026-33825). Beyond those high-visibility issues, eight vulnerabilities are rated Critical — most of them Remote Code Execution (RCE) flaws — and dozens more allow elevation of privilege, information disclosure or denial-of-service conditions. For security teams, this month’s guidance is straightforward: prioritize the actively exploited SharePoint fix, treat the publicly disclosed Defender issue as urgent, and deploy the Critical RCE patches across affected systems without delay.

What was patched this month

Microsoft’s patch set spans a wide array of components: Windows kernel subsystems, networking stacks (TCP/IP, UPnP), Active Directory, Print Spooler and LSASS, Remote Desktop components, Office applications (Word, Excel, PowerPoint), .NET Framework and Visual Studio, Azure agents and Logic Apps, SQL Server, Hyper-V, Windows services such as Function Discovery and Desktop Window Manager, and several user-facing tools like Snipping Tool. The Windows UPnP Device Host and networking subsystems saw concentrated hardening, while document-related engines (Office suite) again accounted for multiple RCE and information-disclosure fixes.

Key high-risk vulnerabilities

• CVE-2026-32201 (SharePoint Server) — Spoofing vulnerability that Microsoft has confirmed is being actively exploited in the wild. Organizations using SharePoint should treat this as an emergency remediation.
• CVE-2026-33825 (Microsoft Defender) — An elevation-of-privilege flaw that was publicly disclosed prior to the patch release. Public disclosure increases the likelihood of exploitation; patch promptly.
• Critical-rated Remote Code Execution flaws — Eight Critical CVEs this month, most enabling remote code execution across core Windows services and protocols. Notable Critical RCEs include Windows TCP/IP (CVE-2026-33827), Active Directory (CVE-2026-33826), and Remote Desktop Client (CVE-2026-32157).

Impact breakdown

Notable CVEs (selection)

Recommended actions for security teams

• Immediate: Patch SharePoint servers for CVE-2026-32201. Treat as emergency remediation where SharePoint is Internet-facing or accessible to many users.
• Urgent: Apply the Defender patch for CVE-2026-33825 because of prior public disclosure.
• Critical: Deploy all Critical-rated RCE patches (Windows TCP/IP, Active Directory, Remote Desktop Client, Office RCEs). RCE bugs at the network or service layer can lead to wormable outcomes in some environments.
• Review and test: WSUS-related and BitLocker-affecting fixes (CVE-2026-32224, CVE-2026-27913) to ensure update delivery and disk encryption integrity are not undermined during remediation.
• Audit: Inventory exposed services (RDP, SharePoint, SQL Server, UPnP), ensure exposure is minimized, and enable compensating controls (network segmentation, least privilege, multi-factor authentication).
• Monitoring: Increase EDR/IDS/IPS monitoring for exploitation indicators tied to the patched CVEs and hunt for suspicious activity around SharePoint and Defender components.

What this means for organizations

April’s Patch Tuesday is a reminder that Microsoft’s broad platform footprint creates many potential attack surfaces. Organizations should prioritize fixes that are actively exploited or publicly disclosed, focus resources on Critical RCE patches that threaten remote compromise, and maintain robust patch testing and deployment pipelines to avoid gaps. Teams with exposed SharePoint, Active Directory, and Remote Desktop services should expedite remediation and bolster monitoring while updates are applied.

Licensed under CC BY-ND 4.0 International

You Might Also Like

Microsoft Links Medusa Ransomware Affiliate to Zero-Day Exploitation Campaign

Microsoft’s recent analysis tying a Medusa ransomware affiliate to a campaign that…

Apr 6, 2026 · 4 min read High Match

Micropatches for Windows Shell Bypass (CVE-2026-21510): What 0patch Fixed and Why It Matters

Microsoft released fixes earlier this year for CVE-2026-21510, a security feature bypass…

Apr 14, 2026 · 4 min read High Match

How a Flippa Purchase Turned 30+ “Essential Plugin” WordPress Plugins into Backdoor Bait

Last week I encountered a supply-chain incident that felt eerily familiar but…

Apr 14, 2026 · 7 min read Related

Researcher Publishes Windows Defender 0-Day ‘BlueHammer’ LPE Proof‑of‑Concept

A security researcher using the handle Chaotic Eclipse has publicly released a…

Apr 7, 2026 · 5 min read Related