Microsoft Released April 2026 Software Updates
Microsoft has released software updates as part of its April 2026 Patch Tuesday. The updates fix 167 security vulnerabilities in total, including 2 zero-day vulnerabilities.
The breakdown of the vulnerabilities are as follows:
93 privilege escalation
13 security feature bypass
20 remote code execution
21 information disclosure
10 denial of service
9 spoofing
The publicly disclosed zero-days are as follows:
CVE-2026-32201 - vulnerability in SharePoint Server that can lead to spoofing
CVE-2026-33825 - vulnerability in Defender that can lead to elevation of privilege
Why You Should Care?
Zero-day vulnerabilities are vulnerabilities where a flaw has been identified but there was no fix for the flaw, which means attackers will try to exploit as many targets as possible before users fix the vulnerability. This makes it extra dangerous, and needs to be addressed as soon as possible.
In this case, two zero-day vulnerabilities are publicly disclosed or actively exploited, which means attackers will likely rush to write exploit code and start attacking businesses. It is only a matter of time before the attackers compromise your business. Now that patches are available, it is critical to apply the patches as soon as possible to avoid getting compromised.
What Should You Do?
Test the patches ASAP at your organization, and make sure it does not break any business applications
Prioritize patching the zero-day vulnerabilities
Roll out the rest of the Patch Tuesday updates
References
https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/