Microsoft April 2026 Patch Tuesday — 163 CVEs / 88 Advisories (CVE-2026-32201 SharePoint Zero-Day Exploited In-The-Wild, CVE-2026-33825 Defender EoP Public PoC, CVE-2026-33824 IKE RCE CVSS 9.8, CVE-2026-33827 TCP/IP Wormable RCE)

Microsoft April 2026 Patch Tuesday (TL-2026-0391), also tracked as Microsoft April 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-19. It has no confirmed attribution, affects Microsoft SharePoint Server, references 15 CVEs (CVE-2026-32201, CVE-2026-20945, CVE-2026-33825), maps to 27 MITRE ATT&CK techniques (T1003, T1021, T1041), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0391

Threat ID
TL-2026-0391
Also known as
Microsoft April 2026 Patch Tuesday, MSRC April 2026, April 2026 Security Update, BlueHammer (CVE-2026-33825 PoC)
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-19
Last reviewed
2026-04-19
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, technology, energy, manufacturing, defense, education, legal, telecommunications, retail, transportation
Target regions
North America, Europe, Asia-Pacific, Latin America, Middle East, Africa, Global
Detection rules
9
Indicators of compromise
20

Microsoft's April 2026 Patch Tuesday (released 2026-04-14) remediates 163 CVEs across 88 advisories — the second-largest Patch Tuesday on record. One zero-day (CVE-2026-32201, SharePoint Server spoofing) is confirmed exploited in the wild, and one publicly disclosed flaw (CVE-2026-33825, Microsoft Defender EoP) ships with a public 'BlueHammer' PoC released on GitHub 2026-04-03. The release includes eight Critical RCEs — notably CVE-2026-33824 (Windows IKE Extensions RCE, CVSS 9.8), CVE-2026-33827 (Windows TCP/IP RCE, CVSS 8.1, wormable on IPv6/IPSec hosts), CVE-2026-33826 (Active Directory RCE, CVSS 8.0), and CVE-2026-32157 (Remote Desktop Client RCE, CVSS 8.8) — alongside multiple Office/Word RCEs triggerable via Preview Pane. Enterprise Windows estates face emergency patching obligations with CISA KEV additions imminent.

How Microsoft April 2026 Patch Tuesday works

On 2026-04-14, Microsoft released its April 2026 Patch Tuesday security update covering 163 CVEs across 88 distinct Security Update Guide advisories. By severity, 8 are rated Critical, 154 Important, and 1 Moderate. By impact class: Elevation of Privilege dominates at 93 CVEs (57.1%), followed by 21 Information Disclosure, 20 Remote Code Execution, 13 Security Feature Bypass, 10 Denial of Service, and 9 Spoofing. Roughly 30 additional Chromium-based Microsoft Edge CVEs ship alongside.

The most urgent issue is CVE-2026-32201, a SharePoint Server spoofing vulnerability (CVSS 6.5) that Microsoft explicitly labels 'Exploited' in its disclosure, making it the month's only confirmed in-the-wild zero-day. Root cause is improper input validation in a SharePoint server-side component that permits unauthenticated cross-site-scripting–class spoofing over the network. Successful exploitation enables an unauthenticated attacker to view sensitive information and inject content into authenticated user sessions, enabling credential capture, session token theft, and pivot to on-premises Active Directory from Internet-exposed SharePoint farms. Affected versions include SharePoint Server 2016, 2019, and Subscription Edition. A sister bug, CVE-2026-20945 (CVSS 4.6, also Spoofing), affects the same attack surface but is not yet observed in exploitation.

CVE-2026-33825 is a Microsoft Defender Antimalware Platform Elevation of Privilege (CVSS 7.8). The vulnerability, credited to researchers Zen Dodd and Yuanpei XU (HUST, via Diffract), permits a local low-privileged attacker to elevate to NT AUTHORITY\SYSTEM by abusing a flaw in Defender's malware-scanning engine. A public PoC named 'BlueHammer' was published on GitHub on 2026-04-03, predating Microsoft's fix by 11 days. Remediation ships via Defender Antimalware Platform version 4.18.26030.3011 (automatic channel) rather than the monthly cumulative. Because the PoC is already public and the bug yields SYSTEM on every unpatched Windows 10/11/Server host, this class typically sees rapid integration into commodity loaders and post-exploitation toolchains.

Among Critical-rated RCEs, two exhibit wormable potential on standard enterprise deployments. CVE-2026-33824 (Windows IKE Service Extensions Remote Code Execution, CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) permits an unauthenticated remote attacker to trigger code execution through crafted IKE packets delivered to UDP ports 500 and 4500 on any host running the IKE service (commonly enabled for IPsec VPN and AlwaysOn VPN scenarios). Blocking UDP/500 and UDP/4500 at the network perimeter materially reduces external exposure but leaves insider/lateral-movement paths open. CVE-2026-33827 (Windows TCP/IP Remote Code Execution, CVSS 8.1) affects Windows hosts with both IPv6 and IPSec enabled; exploitation is gated by a race condition, partially limiting reliability but not preventing eventual worming through a flat IPv6-enabled estate. CVE-2026-33826 (Windows Active Directory Remote Code Execution, CVSS 8.0) requires an authenticated, network-adjacent attacker but yields code execution on Domain Controllers — an outcome equivalent to domain compromise.

The Office/productivity surface received three Critical RCEs: CVE-2026-33114 and CVE-2026-33115 (Microsoft Word RCE, CVSS 8.4 each) and CVE-2026-32190 (Microsoft Office RCE, CVSS 8.4). All three are triggerable via Outlook's Preview Pane when a user previews a malicious message containing an embedded or attached Office document, removing the user-click requirement that normally gates Office RCEs and raising the severity against phishing campaigns. CVE-2026-32157 (Remote Desktop Client RCE, CVSS 8.8) targets the mstsc.exe client when connecting to a malicious RDP endpoint — a well-known precursor pattern to red-team and ransomware-affiliate luring campaigns.

Secondary but notable issues include CVE-2026-27913 (Windows BitLocker Secure Boot bypass, CVSS 7.7, 'Exploitation More Likely'), which permits an attacker with physical or local access to bypass UEFI Secure Boot and inject a bootkit; CVE-2026-26151 (Remote Desktop Spoofing, CVSS 7.1), credited to the UK National Cyber Security Centre and requiring a crafted RDP file to trick a user; and CVE-2026-23666 (.NET Framework Denial of Service, CVSS 7.5). Chromium-based Edge receives ~30 high-severity memory-safety fixes, including CVE-2026-5858 (heap buffer overflow in WebML) and CVE-2026-5859 (integer overflow in WebML), forwarded from the upstream Chromium security release.

Affected products span Windows 10 (21H2, 22H2), Windows 11 (22H2, 23H2, 24H2, 25H2), Windows Server 2016/2019/2022/2025, SharePoint Server 2016/2019/Subscription Edition, Microsoft Office 2016/2019/LTSC 2021/LTSC 2024/Microsoft 365 Apps, Exchange Server 2019 CU14/CU15, Microsoft Edge (Chromium), .NET Framework 3.5/4.8/4.8.1, .NET 6/8/9, Visual Studio 2022, Azure services (Arc, Monitor Agent, Stack HCI), Hyper-V, Microsoft Defender Antimalware Platform, and Remote Desktop Client. CISA KEV additions for CVE-2026-32201 and CVE-2026-33825 are anticipated within 24–72 hours of patch release per historical precedent, triggering BOD 22-01 federal patching obligations.

Recommended response: (1) Emergency-patch Internet-exposed SharePoint farms for CVE-2026-32201 and CVE-2026-20945 within 24 hours; (2) Emergency-patch Domain Controllers, IKE/IPsec endpoints, and IPv6-enabled servers for CVE-2026-33824/33826/33827 within 72 hours; (3) Force Defender Antimalware Platform update to 4.18.26030.3011 immediately to close the public-PoC CVE-2026-33825; (4) Apply the standard monthly cumulative across the remaining fleet within the 7-day window; (5) Block UDP/500 and UDP/4500 at the network perimeter as a compensating control for IKE; (6) Hunt for SharePoint spoofing exploitation using the detection rules published with this threat.

MITRE ATT&CK techniques used in TL-2026-0391

Credential Access

T1003 OS Credential Dumping; T1539 Steal Web Session Cookie

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1482 Domain Trust Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing

Defense Evasion

T1211 Exploitation for Stealth

Collection

T1213 Data from Information Repositories

Persistence

T1542 Pre-OS Boot; T1543 Create or Modify System Process

Impact

T1565 Data Manipulation

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Microsoft April 2026 Patch Tuesday

  • Microsoft — SharePoint Server
    Vulnerable versions: 2016; 2019; Subscription Edition
    Fixed in: 2016 with KB5045991; 2019 with KB5045992; Subscription Edition with KB5045993
  • Microsoft — Windows 10
    Vulnerable versions: 21H2; 22H2
    Fixed in: April 2026 cumulative update
  • Microsoft — Windows 11
    Vulnerable versions: 22H2; 23H2; 24H2; 25H2
    Fixed in: April 2026 cumulative update
  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022; 2025
    Fixed in: April 2026 cumulative update
  • Microsoft — Microsoft Office
    Vulnerable versions: 2016; 2019; LTSC 2021; LTSC 2024; Microsoft 365 Apps
    Fixed in: April 2026 Office security update
  • Microsoft — Exchange Server
    Vulnerable versions: 2019 CU14; 2019 CU15
    Fixed in: April 2026 Security Update
  • Microsoft — Microsoft Defender Antimalware Platform
    Vulnerable versions: < 4.18.26030.3011
    Fixed in: 4.18.26030.3011
  • Microsoft — .NET / .NET Framework
    Vulnerable versions: .NET Framework 3.5/4.8/4.8.1; .NET 6; .NET 8; .NET 9
    Fixed in: April 2026 .NET security update
  • Microsoft — Microsoft Edge (Chromium)
    Vulnerable versions: < April 2026 Chromium release
    Fixed in: April 2026 Edge Stable channel build
  • Microsoft — Visual Studio
    Vulnerable versions: 2022
    Fixed in: April 2026 servicing update

Remediation for Microsoft April 2026 Patch Tuesday

Patches

  • Apply Microsoft April 2026 Patch Tuesday cumulative updates across all Windows 10/11/Server hosts
  • SharePoint Server 2016 KB5045991
  • SharePoint Server 2019 KB5045992
  • SharePoint Server Subscription Edition KB5045993
  • Microsoft Defender Antimalware Platform 4.18.26030.3011
  • Microsoft 365 Apps / Office 2016/2019/LTSC 2021/LTSC 2024 April 2026 security updates
  • Exchange Server 2019 CU14/CU15 April 2026 SU
  • Microsoft Edge Chromium build containing fixes for CVE-2026-5858 and CVE-2026-5859
  • .NET 6/8/9 and .NET Framework April 2026 security updates

Immediate actions

  • Emergency-patch Internet-exposed SharePoint Server 2016/2019/Subscription Edition within 24 hours for CVE-2026-32201 and CVE-2026-20945
  • Force Microsoft Defender Antimalware Platform update to version 4.18.26030.3011 to close CVE-2026-33825 (public BlueHammer PoC available)
  • Apply April 2026 cumulative updates to Domain Controllers within 72 hours for CVE-2026-33826 (Active Directory RCE)
  • Block inbound UDP/500 and UDP/4500 at the network perimeter as compensating control for CVE-2026-33824 (IKE RCE) until patching completes
  • Disable or restrict IPv6/IPSec on Internet-facing Windows servers pending CVE-2026-33827 patching
  • Hunt for SharePoint spoofing exploitation using the detection content associated with this threat

Workarounds

  • SharePoint: restrict anonymous and Internet access; enable AMSI integration for SharePoint in all farms
  • IKE RCE: stop and disable the IKEEXT service on hosts that do not require IPsec ('sc stop IKEEXT; sc config IKEEXT start= disabled')
  • TCP/IP: disable IPv6 via registry 'DisabledComponents' = 0xFF on hosts not requiring IPv6
  • Office RCE: disable Outlook Preview Pane organization-wide via GPO until Word/Office patches are deployed
  • RDP Client: block outbound TCP/3389 to untrusted destinations and block .rdp file attachments at the mail gateway

Longer-term hardening

  • Isolate on-premises SharePoint farms behind Entra Application Proxy or a reverse-proxy WAF with request-body inspection
  • Enforce Attack Surface Reduction (ASR) rule 'Block Office applications from creating child processes' to blunt CVE-2026-33114/33115/32190 preview-pane RCEs
  • Deploy EDR with behavioral detection for Defender tampering and SYSTEM-level privilege escalation primitives
  • Enable LSA Protection (RunAsPPL) and Credential Guard on all Windows 10/11/Server endpoints
  • Segment Domain Controllers into a dedicated tier-0 network with restricted inbound from member workstations
  • Disable IPv6 on hosts that do not require it to reduce TCP/IP stack RCE attack surface

CVEs associated with Microsoft April 2026 Patch Tuesday

Weaknesses (CWE) in Microsoft April 2026 Patch Tuesday

CWE-79, CWE-20, CWE-269, CWE-362, CWE-787, CWE-190, CWE-284, CWE-287, CWE-400, CWE-502

Timeline of Microsoft April 2026 Patch Tuesday

  • 'BlueHammer' public proof-of-concept for CVE-2026-33825 (Microsoft Defender Antimalware Platform Elevation of Privilege) is published to GitHub, predating Microsoft's patch by 11 days.
  • Third-party telemetry observes in-the-wild exploitation attempts of the SharePoint Server spoofing vulnerability later assigned CVE-2026-32201, targeting Internet-exposed on-premises SharePoint farms.
  • Zero Day Initiative publishes its April 2026 Security Update Review detailing the wormable characteristics of the IKE and TCP/IP RCEs.
  • Microsoft Defender Antimalware Platform version 4.18.26030.3011 ships via the automatic update channel, closing the CVE-2026-33825 'BlueHammer' public PoC.
  • Microsoft Security Response Center (MSRC) releases detailed advisories for each CVE including CVE-2026-33824 (IKE RCE, CVSS 9.8), CVE-2026-33827 (TCP/IP RCE, CVSS 8.1), CVE-2026-33826 (Active Directory RCE, CVSS 8.0), and CVE-2026-32157 (Remote Desktop Client RCE, CVSS 8.8).
  • Microsoft publishes the April 2026 Patch Tuesday release, remediating 163 CVEs across 88 advisories — including two zero-day-class issues (CVE-2026-32201 and CVE-2026-33825) and eight Critical-rated RCEs.
  • BleepingComputer, Malwarebytes, SecurityAffairs, CyberSecurityNews, and GBHackers publish independent analyses, all highlighting the SharePoint zero-day and the BlueHammer PoC.
  • Sophos News publishes an enterprise-defender-oriented roundup of the April 2026 Patch Tuesday release emphasizing KEV-candidate CVEs and patch-prioritization guidance.
  • Threadlinqs Intelligence Researcher documents the full patch cycle, including D1-aligned research JSON, MITRE mapping, and IOC extraction for TL-2026-0391.
  • As of 2026-05-29, this April 2026 Patch Tuesday set is fully patched but remains a live concern: CVE-2026-32201 (SharePoint) and CVE-2026-33825 (BlueHammer Defender) are CISA KEV-listed zero-days exploited in the wild. Exploitation and exposure persisted into May (1,370+ unpatched SharePoint servers; wormable IKE/TCP-IP RCEs still high-risk on unpatched estates).

Sources cited for Microsoft April 2026 Patch Tuesday

Threats related to Microsoft April 2026 Patch Tuesday

Detection coverage for TL-2026-0391

As of 2026-04-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0391 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats