Microsoft's April 2026 Patch Tuesday Ships 163 Fixes, Including an Exploited SharePoint Spoofing Flaw and a Publicly Disclosed Defender Escalation
April's update is Microsoft's second-largest Patch Tuesday on record, with 8 critical flaws, two zero-days, and privilege escalation bugs accounting for well over half of the patches.
Overview
Microsoft released its April 2026 Patch Tuesday updates on April 14, addressing 163 vulnerabilities across Windows, Office, SharePoint, Active Directory, Defender, and networking components. According to Tenable, it is the second-largest monthly release in Microsoft’s history, trailing only the record set earlier in the year. Two of the patched flaws qualify as zero-days: one actively exploited in the wild and one publicly disclosed with working exploit code circulating before the fix shipped.
The update continues a pattern previously reported by The Machine Herald, in which Microsoft’s monthly cadence has grown markedly heavier through the first quarter of 2026.
What We Know
Scale and severity
Microsoft’s own advisory count is 163 CVEs, of which 8 are rated critical, 154 important, and 1 moderate, as summarized by Tenable and corroborated by Qualys. BleepingComputer counts 167 flaws when including additional re-released and bundled fixes, and lists seven of the eight criticals as remote code execution bugs with the remaining one a denial-of-service issue.
The category breakdown is striking. Qualys reports 93 elevation-of-privilege vulnerabilities out of the 163 fixed — roughly 57 percent of the release — followed by 20 remote code execution, 20 information disclosure, 12 security feature bypass, 9 denial of service, and 8 spoofing entries. BleepingComputer offers a similar distribution with 93 EoP, 21 information disclosure, 20 RCE, 13 security feature bypass, 10 DoS, and 9 spoofing.
The exploited zero-day: CVE-2026-32201
CVE-2026-32201 is a SharePoint Server spoofing vulnerability caused by improper input validation. Per Qualys, the flaw allows an unauthenticated attacker to perform spoofing attacks over a network, and CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 28, 2026. Tenable reports a CVSS score of 6.5 and notes that patches are available for SharePoint 2016, SharePoint 2019, and SharePoint Server Subscription Edition.
The disclosed zero-day: CVE-2026-33825 (“BlueHammer”)
The second zero-day, CVE-2026-33825, is a Microsoft Defender elevation-of-privilege bug that grants SYSTEM-level access from a local user context. According to Tenable, the vulnerability carries a CVSSv3 score of 7.8 and was “publicly disclosed prior to a patch being made available.” A researcher operating under the alias “Chaotic Eclipse” posted proof-of-concept code to GitHub on April 3 and publicly criticized Microsoft’s handling of the disclosure process. BleepingComputer reports the fix ships in Microsoft Defender Antimalware Platform version 4.18.26050.3011, which rolls out automatically through Defender’s update channel.
Other critical flaws
Tenable highlights two critical remote code execution issues beyond the zero-days: CVE-2026-33824, an IKE Services RCE with a CVSS score of 9.8, and CVE-2026-33826, an Active Directory RCE rated 8.0. BleepingComputer adds that several of the critical Office RCEs in Word and Excel can be triggered via the preview pane when a malicious document is received by email, and Microsoft is urging administrators to prioritize Office updates on systems that process external attachments.
What We Don’t Know
Microsoft has not disclosed who is exploiting the SharePoint spoofing flaw or the scope of intrusions tied to it, only confirming that active exploitation occurred. It is also unclear whether the BlueHammer exploit has been weaponized beyond the original proof-of-concept release; neither Microsoft nor the researchers behind the disclosure have reported observed in-the-wild abuse, though the publicly available code lowers the barrier for opportunistic attackers.
The differing CVE counts between trackers — 163 in Microsoft’s primary advisory versus 167 reported by BleepingComputer — reflect how separate outlets tally re-released advisories and bundled third-party components, not a substantive disagreement about the release itself.
Analysis
The April release extends a 2026 trend toward very large monthly updates dominated by post-compromise exploitation primitives. With 93 elevation-of-privilege bugs in a single month, more than half of Microsoft’s fixes this cycle address the kind of flaws attackers chain after they already have a foothold — consistent with a threat landscape where initial access is increasingly commoditized and the premium sits on escalation paths to SYSTEM or domain admin. The CISA-mandated remediation deadline on the SharePoint flaw, combined with the publicly available Defender exploit, gives defenders a narrow and clearly bounded window to act before opportunistic exploitation spreads.