Cybersecurity — 2026-04-14

Microsoft April Patch Tuesday Fixes 167 Flaws Including Actively Exploited SharePoint Zero-Day

Microsoft released security updates addressing 167 vulnerabilities with eight rated critical. CVE-2026-32201, a SharePoint spoofing vulnerability, was confirmed exploited in the wild as a zero-day affecting SharePoint 2016, 2019, and Subscription Edition. A second vulnerability, CVE-2026-33825 in Microsoft Defender, was publicly disclosed prior to patching. CVE-2026-33826, a critical RCE flaw in Windows Active Directory with a CVSS score of 8, was assessed as exploitation more likely. The patch volume is among Microsoft's largest monthly releases.

Analysis
The 167-flaw volume combined with an actively exploited SharePoint zero-day places sustained pressure on enterprise patch management cycles already strained by the Adobe emergency patch days earlier. The Windows AD RCE vulnerability is the highest-risk item for intelligence and government networks because AD compromise provides domain-wide lateral movement. Microsoft's own Defender and SharePoint were simultaneously vulnerable, compounding risk for organizations dependent on the Microsoft ecosystem for both operations and defense.

2 sources

Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days - BleepingComputer
Microsofts April 2026 Patch Tuesday Addresses 163 CVEs - Tenable