Microsoft April 2026 Patch Tuesday: Key Security Insights

SharePoint Server administrators face an urgent patching deadline as one of the vulnerabilities in Microsoft’s April 2026 Patch Tuesday release is already under active exploitation. The spoofing flaw is one of 167 vulnerabilities addressed in the update, which was released on April 14 across Windows, Office, SharePoint, and other products.

Overview of the April 2026 Patch Tuesday

This release marks the second-largest monthly update in Microsoft’s history. Of the 167 vulnerabilities patched:

• Eight carry the highest severity rating.
• Seven are classified as remote code execution flaws.
• One is a denial-of-service vulnerability.

Among these, two zero-days were disclosed, with one actively exploited prior to patching.

Actively Exploited SharePoint Zero-Day (CVE-2026-32201)

CVE-2026-32201, a spoofing vulnerability in Microsoft SharePoint Server, is the actively exploited zero-day patched in this release. According to Microsoft’s advisory, this flaw stems from an input validation weakness that allows unauthenticated attackers to perform network-based spoofing attacks. Successful exploitation grants attackers read and write access to sensitive data, although system availability remains unaffected.

Key details:

• Any SharePoint Server instance reachable from the network is a potential target as no authentication is required.
• Microsoft has not disclosed the exploitation methodology or the identity of the vulnerability’s discoverer.

SharePoint Server has been a recurring target for sophisticated threat actors. For instance, a separate zero-day (CVE-2025-53770) was linked to ransomware attacks targeting government agencies in July 2025. SharePoint’s deep integration with Active Directory and enterprise file storage makes it a high-value target for attackers seeking to move laterally across networks.

Structural Challenges in On-Premises SharePoint Deployments

The exploitation of two SharePoint zero-days within nine months highlights a structural exposure in on-premises deployments. Organizations that have not migrated to SharePoint Online face increasing pressure to do so, as the cloud-hosted version benefits from:

• Automated patching without administrator intervention.
• Additional layers of network-level protection absent in self-hosted deployments.

Administrators unable to immediately apply the update should:

1. Review network segmentation around SharePoint endpoints.
2. Audit access logs for signs of pre-patch exploitation activity.

Second Zero-Day: Microsoft Defender Vulnerability (CVE-2026-33825)

CVE-2026-33825, the second zero-day patched in April, is an elevation of privilege flaw in the Microsoft Defender Antimalware Platform. Although publicly disclosed prior to patching, it has not been linked to active exploitation. Successful exploitation could escalate privileges to SYSTEM-level, granting attackers full control over the affected system.

Key details:

• Defender’s elevated permissions by default make this flaw particularly dangerous, as attackers could disable security protections entirely.
• Security researchers Zen Dodd and Yuanpei XU identified the vulnerability using the Diffract fuzzing tool.
• The fix was delivered via Defender Antimalware Platform update version 4.18.26050.3011, which downloads automatically to systems running Windows Defender.

Administrators need not take manual action for this fix unless:

• Automatic Defender updates have been disabled.
• Third-party antivirus solutions that replace Defender are in use, requiring manual verification of the update.

Diverging Risk Profiles in Patch Deployment

Microsoft Defender updates reach endpoints within hours due to silent automatic deployment. In contrast, SharePoint Server patches require manual testing and scheduled deployment, creating two distinct risk profiles:

• Defender fixes are measured in hours of exposure.
• SharePoint Server patches may take days or weeks to deploy.

Breakdown of April 2026 Vulnerabilities

By category, the 167 vulnerabilities include:

• 93 Elevation of Privilege
• 20 Remote Code Execution
• 21 Information Disclosure
• 13 Security Feature Bypass
• 10 Denial of Service
• 9 Spoofing

Elevation of Privilege vulnerabilities represent more than half of the total.

Enterprise Risks Beyond SharePoint

Beyond the two zero-days, Microsoft addressed multiple remote code execution bugs in Office. Attackers can exploit these simply by having a victim preview a malicious document. No additional interaction is required beyond viewing the file in Outlook’s preview pane, making these flaws especially dangerous in enterprise environments.

Potential threat vectors include:

• Crafted Word or Excel files designed to execute arbitrary code upon preview.
• Remote Desktop Client vulnerabilities that could serve as a bridgehead into corporate networks.

Additional Information

The Patch Tuesday tally excludes fixes for Mariner, Azure, and Bing addressed earlier in April, as well as 80 Microsoft Edge and Chromium vulnerabilities patched by Google. Counting all Microsoft-related updates, the total footprint for April 2026 is significantly larger than 167 vulnerabilities.

Windows 11 users receive the cumulative update as KB5083769, which also includes feature updates such as:

• A Smart App Control toggle.
• Narrator integration with Copilot.
• Support for display refresh rates above 1000Hz.

Windows 10 users on the Extended Security Update program receive a separate cumulative update, KB5082200. These patches address the same vulnerabilities but apply only to organizations enrolled in the paid ESU program, adding cost pressure for those still running Windows 10 beyond its October 2025 end-of-support date.

Conclusion

April’s 167 vulnerabilities represent the largest single-month total of 2026, nearly tripling February’s count. Attackers are discovering and weaponizing vulnerabilities faster, often before patches are available. This trend underscores the need for automated patch deployment where possible and highlights the growing operational burden on IT administrators managing hybrid infrastructures.

For on-premises SharePoint deployments, every day between now and successful patching represents a critical window of exposure. Organizations subject to CISA's Binding Operational Directive 22-01 should expect the actively exploited SharePoint vulnerability to be added to the Known Exploited Vulnerabilities (KEV) catalog, setting a mandatory remediation deadline for affected entities.

Source: Microsoft Security Response Center (MSRC)