Zero-Days Fixed
The most critical patches address two flaws that were either already being used in the wild or were exposed to the public before a fix was available:
Actively Exploited Zero-Day (Spoofing)
CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Impact - This vulnerability arises from improper input validation in SharePoint Server. An unauthenticated attacker can perform network spoofing, potentially tricking users into trusting malicious content or hijacking sessions. CISA has added this to its Known Exploited Vulnerabilities catalog, requiring immediate remediation by April 28, 2026.
Publicly Disclosed Zero-Day (Elevation of Privilege)
CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability ("BlueHammer")
Impact - Disclosed publicly earlier this month as "BlueHammer," this flaw allows a local attacker with low privileges to gain SYSTEM-level access by abusing Defender’s signature update mechanism. While Microsoft Defender typically updates itself automatically (Platform version 4.18.26050.3011+), IT admins should verify that all endpoints have received the fix.
Critical Vulnerabilities to Prioritise
Beyond the zero-days, eight vulnerabilities received a "Critical" rating, with several Remote Code Execution (RCE) flaws posing a severe risk to internet-facing systems,
- CVE-2026-33824 - Windows Internet Key Exchange (IKE) RCE (CVSS 9.8) - A high-severity flaw in the IKE protocol. An unauthenticated attacker could execute code by sending crafted packets to a target with IKEv2 enabled. If immediate patching is not possible, it is recommended to block UDP ports 500 and 4500 at the firewall.
- CVE-2026-32190, CVE-2026-33114 & CVE-2026-33115 - Microsoft Office & Word Critical RCE - These vulnerabilities allow code execution via the Outlook Preview Pane. Like the January flaws, these are particularly dangerous because a user does not need to open the malicious document to be compromised.
- CVE-2026-33826 - Windows Active Directory Remote Code Execution - This flaw allows an authenticated attacker on an adjacent network to execute code by sending a specially crafted RPC call to a host. It is a prime target for lateral movement within a domain.
Vulnerabilities by Category
The April 2026 updates addressed a total of 167 flaws, categorised as follows,
- Elevation of Privilege Vulnerabilities – 93
- Remote Code Execution Vulnerabilities – 20
- Information Disclosure Vulnerabilities – 21
- Security Feature Bypass Vulnerabilities – 13
- Denial of Service Vulnerabilities – 10
- Spoofing Vulnerabilities – 9
- Tampering Vulnerabilities – 1
- Total Flaws – 167
Need Help with Patch Management?
Struggling with the increasing volume of monthly patches? NOCTeam can secure your environment with proactive Patch Management and Endpoint Detection and Response (EDR) services.
Contact us today at [email protected] for a free assessment of your IT systems.
Originally published on LinkedIn.