April Patch Tuesday Updates Address Critical Flaws Across Major Vendors
Summary
April’s patch releases cover many vendors. Adobe Acrobat Reader CVE-2026-34621 and Microsoft SharePoint CVE-2026-32201 are reported as actively exploited; other highlighted fixes address critical SAP and FortiSandbox flaws.
Key points
- SAP BPC/BW CVE-2026-27681 is a critical SQL injection flaw that could let low-privileged users execute arbitrary SQL against data stores.
- Adobe Acrobat Reader CVE-2026-34621 is reported to be actively exploited, but the article says the affected population, threat actor and targets are unknown.
- FortiSandbox CVE-2026-39813 and CVE-2026-39808 could allow unauthenticated authentication bypass and OS command execution via crafted HTTP requests.
- Microsoft patched 169 vulnerabilities, including SharePoint Server CVE-2026-32201, a spoofing flaw the company says is actively exploited.
- Adobe also fixed five ColdFusion flaws that could enable code execution, denial of service, file reads or security feature bypass.
- The roundup lists security updates from numerous other vendors and software distributors.
Article Details
- Event Type
- April Patch Tuesday security updates addressing critical and high-severity vulnerabilities across multiple vendors.
- Impact
- The updates address flaws that could allow arbitrary database command execution in SAP Business Planning and Consolidation and SAP Business Warehouse, remote code execution in Adobe Acrobat Reader, authentication bypass and command execution in FortiSandbox, and sensitive-information exposure in Microsoft SharePoint Server. The article reports active in-the-wild exploitation of the Adobe Acrobat Reader and SharePoint Server vulnerabilities; the extent, targets, and perpetrators of the Adobe exploitation are unknown.
CVE
CVE-2026-27282Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-27282 (CVSS score: 7.5) – An improper input validation vulnerability leading to security feature bypassCVE-2026-27304Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-27304 (CVSS score: 9.3) – An improper input validation vulnerability leading to arbitrary code executionCVE-2026-27305Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-27305 (CVSS score: 8.6) – A path traversal vulnerability leading to arbitrary file system readCVE-2026-27306Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-27306 (CVSS score: 8.4) – An improper input validation vulnerability leading to arbitrary code executionCVE-2026-27681SAP_SE · SAP Business Planning and Consolidation and SAP Business Warehousevendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681, CVSS 9.9) that can execute arbitrary database commands.CVE-2026-32201Microsoft · Sharepoint serverMicrosoft patched 169 vulnerabilities, including an actively exploited SharePoint Server spoofing bug (CVE-2026-32201) that could expose sensitive information.CVE-2026-34619Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-34619 (CVSS score: 7.7) – A path traversal vulnerability leading to security feature bypassCVE-2026-34621Adobe · Acrobat 2024; Adobe · Acrobat DC; +1 moreAdobe Acrobat Reader (CVE-2026-34621) is facing active in-the-wild RCE exploitation while FortiSandbox and Microsoft SharePoint Server also received fixes for high-severity flaws.CVE-2026-39808Fortinet · FortiSandbox; Fortinet · FortiSandbox PaaSTwo critical FortiSandbox flaws (CVE-2026-39813 and CVE-2026-39808, CVSS 9.1) enable unauthenticated authentication bypass and OS command injection via crafted HTTP requests.CVE-2026-39813Fortinet · FortiSandbox; Fortinet · FortiSandbox CloudTwo critical FortiSandbox flaws (CVE-2026-39813 and CVE-2026-39808, CVSS 9.1) enable unauthenticated authentication bypass and OS command injection via crafted HTTP requests.
People
Vendors
AdobeApril’s Patch Tuesday delivered critical fixes across Adobe, Fortinet, Microsoft, SAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681,FortinetApril’s Patch Tuesday delivered critical fixes across Adobe, Fortinet, Microsoft, SAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681,MicrosoftApril’s Patch Tuesday delivered critical fixes across Adobe, Fortinet, Microsoft, SAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681,SAPApril’s Patch Tuesday delivered critical fixes across Adobe, Fortinet, Microsoft, SAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681,
Products
Adobe Acrobat ReaderAdobe Acrobat Reader (CVE-2026-34621) is facing active in-the-wild RCE exploitation while FortiSandbox and Microsoft SharePoint Server also received fixes for high-severity flaws.Adobe ColdFusionAdobe ColdFusion and numerous other vendors and OS distributions also received important fixes—organizations should prioritize applying updates to prevent data theft and operational disruption.FortiSandboxAdobe Acrobat Reader (CVE-2026-34621) is facing active in-the-wild RCE exploitation while FortiSandbox and Microsoft SharePoint Server also received fixes for high-severity flaws.Microsoft SharePoint ServerAdobe Acrobat Reader (CVE-2026-34621) is facing active in-the-wild RCE exploitation while FortiSandbox and Microsoft SharePoint Server also received fixes for high-severity flaws.SAP Business Planning and ConsolidationAdobe, Fortinet, Microsoft, SAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681, CVSS 9.9) that can execute arbitrary databaseSAP Business WarehouseSAP and many other vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681, CVSS 9.9) that can execute arbitrary database commands.