# Microsoft April 2026 Patch Tuesday — 163 CVEs / 88 Advisories (CVE-2026-32201 SharePoint Zero-Day Exploited In-The-Wild, CVE-2026-33825 Defender EoP Public PoC, CVE-2026-33824 IKE RCE CVSS 9.8, CVE-2026-33827 TCP/IP Wormable RCE)

> Microsoft's April 2026 Patch Tuesday (released 2026-04-14) remediates 163 CVEs across 88 advisories — the second-largest Patch Tuesday on record. One zero-day (CVE-2026-32201, SharePoint Server spoofing) is confirmed exploited in the wild, and one publicly disclosed flaw (CVE-2026-33825, Microsoft Defender EoP) ships with a public 'BlueHammer' PoC released on GitHub 2026-04-03. The release includes eight Critical RCEs — notably CVE-2026-33824 (Windows IKE Extensions RCE, CVSS 9.8), CVE-2026-33827 (Windows TCP/IP RCE, CVSS 8.1, wormable on IPv6/IPSec hosts), CVE-2026-33826 (Active Directory RCE, CVSS 8.0), and CVE-2026-32157 (Remote Desktop Client RCE, CVSS 8.8) — alongside multiple Office/Word RCEs triggerable via Preview Pane. Enterprise Windows estates face emergency patching obligations with CISA KEV additions imminent.

- **Published:** 2026-04-19T12:00:00Z
- **Last reviewed:** 2026-04-19T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0391
- **ID:** TL-2026-0391
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32201, CVE-2026-20945, CVE-2026-33825, CVE-2026-33824, CVE-2026-33827, CVE-2026-33826, CVE-2026-32157, CVE-2026-33114, CVE-2026-33115, CVE-2026-32190, CVE-2026-27913, CVE-2026-26151, CVE-2026-23666, CVE-2026-5858, CVE-2026-5859

## Description

On 2026-04-14, Microsoft released its April 2026 Patch Tuesday security update covering 163 CVEs across 88 distinct Security Update Guide advisories. By severity, 8 are rated Critical, 154 Important, and 1 Moderate. By impact class: Elevation of Privilege dominates at 93 CVEs (57.1%), followed by 21 Information Disclosure, 20 Remote Code Execution, 13 Security Feature Bypass, 10 Denial of Service, and 9 Spoofing. Roughly 30 additional Chromium-based Microsoft Edge CVEs ship alongside.

The most urgent issue is CVE-2026-32201, a SharePoint Server spoofing vulnerability (CVSS 6.5) that Microsoft explicitly labels 'Exploited' in its disclosure, making it the month's only confirmed in-the-wild zero-day. Root cause is improper input validation in a SharePoint server-side component that permits unauthenticated cross-site-scripting–class spoofing over the network. Successful exploitation enables an unauthenticated attacker to view sensitive information and inject content into authenticated user sessions, enabling credential capture, session token theft, and pivot to on-premises Active Directory from Internet-exposed SharePoint farms. Affected versions include SharePoint Server 2016, 2019, and Subscription Edition. A sister bug, CVE-2026-20945 (CVSS 4.6, also Spoofing), affects the same attack surface but is not yet observed in exploitation.

CVE-2026-33825 is a Microsoft Defender Antimalware Platform Elevation of Privilege (CVSS 7.8). The vulnerability, credited to researchers Zen Dodd and Yuanpei XU (HUST, via Diffract), permits a local low-privileged attacker to elevate to NT AUTHORITY\SYSTEM by abusing a flaw in Defender's malware-scanning engine. A public PoC named 'BlueHammer' was published on GitHub on 2026-04-03, predating Microsoft's fix by 11 days. Remediation ships via Defender Antimalware Platform version 4.18.26030.3011 (automatic channel) rather than the monthly cumulative. Because the PoC is already public and the bug yields SYSTEM on every unpatched Windows 10/11/Server host, this class typically sees rapid integration into commodity loaders and post-exploitation toolchains.

Among Critical-rated RCEs, two exhibit wormable potential on standard enterprise deployments. CVE-2026-33824 (Windows IKE Service Extensions Remote Code Execution, CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) permits an unauthenticated remote attacker to trigger code execution through crafted IKE packets delivered to UDP ports 500 and 4500 on any host running the IKE service (commonly enabled for IPsec VPN and AlwaysOn VPN scenarios). Blocking UDP/500 and UDP/4500 at the network perimeter materially reduces external exposure but leaves insider/lateral-movement paths open. CVE-2026-33827 (Windows TCP/IP Remote Code Execution, CVSS 8.1) affects Windows hosts with both IPv6 and IPSec enabled; exploitation is gated by a race condition, partially limiting reliability but not preventing eventual worming through a flat IPv6-enabled estate. CVE-2026-33826 (Windows Active Directory Remote Code Execution, CVSS 8.0) requires an authenticated, network-adjacent attacker but yields code execution on Domain Controllers — an outcome equivalent to domain compromise.

The Office/productivity surface received three Critical RCEs: CVE-2026-33114 and CVE-2026-33115 (Microsoft Word RCE, CVSS 8.4 each) and CVE-2026-32190 (Microsoft Office RCE, CVSS 8.4). All three are triggerable via Outlook's Preview Pane when a user previews a malicious message containing an embedded or attached Office document, removing the user-click requirement that normally gates Office RCEs and raising the severity against phishing campaigns. CVE-2026-32157 (Remote Desktop Client RCE, CVSS 8.8) targets the mstsc.exe client when connecting to a malicious RDP endpoint — a well-known precursor pattern to red-team and ransomware-affiliate luring campaigns.

Secondary but notable issues include CVE-2026-27913 (Windows BitLocker Secure Boot bypass, CVSS 7.7, 'Exploitation More Likely'), which permits an attacker with physical or local access to bypass UEFI Secure Boot and inject a bootkit; CVE-2026-26151 (Remote Desktop Spoofing, CVSS 7.1), credited to the UK National Cyber Security Centre and requiring a crafted RDP file to trick a user; and CVE-2026-23666 (.NET Framework Denial of Service, CVSS 7.5). Chromium-based Edge receives ~30 high-severity memory-safety fixes, including CVE-2026-5858 (heap buffer overflow in WebML) and CVE-2026-5859 (integer overflow in WebML), forwarded from the upstream Chromium security release.

Affected products span Windows 10 (21H2, 22H2), Windows 11 (22H2, 23H2, 24H2, 25H2), Windows Server 2016/2019/2022/2025, SharePoint Server 2016/2019/Subscription Edition, Microsoft Office 2016/2019/LTSC 2021/LTSC 2024/Microsoft 365 Apps, Exchange Server 2019 CU14/CU15, Microsoft Edge (Chromium), .NET Framework 3.5/4.8/4.8.1, .NET 6/8/9, Visual Studio 2022, Azure services (Arc, Monitor Agent, Stack HCI), Hyper-V, Microsoft Defender Antimalware Platform, and Remote Desktop Client. CISA KEV additions for CVE-2026-32201 and CVE-2026-33825 are anticipated within 24–72 hours of patch release per historical precedent, triggering BOD 22-01 federal patching obligations.

Recommended response: (1) Emergency-patch Internet-exposed SharePoint farms for CVE-2026-32201 and CVE-2026-20945 within 24 hours; (2) Emergency-patch Domain Controllers, IKE/IPsec endpoints, and IPv6-enabled servers for CVE-2026-33824/33826/33827 within 72 hours; (3) Force Defender Antimalware Platform update to 4.18.26030.3011 immediately to close the public-PoC CVE-2026-33825; (4) Apply the standard monthly cumulative across the remaining fleet within the 7-day window; (5) Block UDP/500 and UDP/4500 at the network perimeter as a compensating control for IKE; (6) Hunt for SharePoint spoofing exploitation using the detection rules published with this threat.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1542 Pre-OS Boot
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1003 OS Credential Dumping
- T1539 Steal Web Session Cookie
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [MSRC Release Notes — April 2026](https://msrc.microsoft.com/update-guide/releaseNote/2026-Apr)
- [Sophos News — Microsoft April 2026 Patch Tuesday](https://news.sophos.com/en-us/2026/04/18/microsoft-april-2026-patch-tuesday/)
- [Tenable — Microsoft's April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)](https://www.tenable.com/blog/microsofts-april-2026-patch-tuesday-addresses-163-cves-cve-2026-32201)
- [BleepingComputer — Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/)
- [Zero Day Initiative — The April 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/4/14/the-april-2026-security-update-review)
- [SecurityAffairs — Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day](https://securityaffairs.com/190831/security/microsoft-patch-tuesday-for-april-2026-fixed-actively-exploited-sharepoint-zero-day.html)
- [Malwarebytes — April Patch Tuesday fixes two zero-days, including one under active attack](https://www.malwarebytes.com/blog/news/2026/04/april-patch-tuesday-fixes-two-zero-days-including-one-under-active-attack)
- [CyberSecurityNews — Microsoft Patch Tuesday April 2026 – 168 Vulnerabilities Fixed](https://cybersecuritynews.com/microsoft-patch-tuesday-april-2026/)
- [GBHackers — Microsoft Patch Tuesday April 2026 Fixes 168 Flaws](https://gbhackers.com/microsoft-patch-tuesday-april-2026/)
- [BlueHammer public PoC for CVE-2026-33825 (Microsoft Defender EoP)](https://github.com/search?q=BlueHammer+CVE-2026-33825&type=repositories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0391