Microsoft’s April 2026 Patch Tuesday Fixes 167 Vulnerabilities, Including Two Zero-Days
Summary
Microsoft’s April 2026 updates fix 167 vulnerabilities, including an actively exploited SharePoint spoofing flaw and a publicly disclosed Defender elevation-of-privilege flaw. Eight issues are Critical; multiple Office RCEs can be triggered through the preview pane or a
Key points
- Microsoft released patches for 167 vulnerabilities; eight are rated Critical, including seven remote code execution flaws and one denial-of-service flaw.
- CVE-2026-32201, a SharePoint Server spoofing vulnerability, was exploited in attacks; Microsoft did not disclose how it was exploited or who disclosed it.
- CVE-2026-33825, a Microsoft Defender elevation-of-privilege flaw, was publicly disclosed and is addressed through a Defender platform update.
- Multiple Word and Excel remote code execution flaws can be triggered through the preview pane or by opening malicious documents.
- The article also notes April security updates from other vendors, including actively exploited flaws in Adobe Reader/Acrobat, Fortinet products, and Google Chrome.
Article Details
- Event Type
- Microsoft April 2026 Patch Tuesday security update
- Impact
- Microsoft released fixes for 167 vulnerabilities, including two zero-days and eight Critical flaws. One zero-day, CVE-2026-32201, was actively exploited and could allow spoofing against SharePoint Server with potential disclosure or modification of information. The publicly disclosed CVE-2026-33825 could grant SYSTEM privileges through Microsoft Defender. Multiple Office remote-code-execution flaws may be triggered through the preview pane or by opening malicious documents.
CVE
CVE-2026-32201Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 morefixes 167 vulnerabilities, including two zero-days (an actively exploited SharePoint spoofing flaw CVE-2026-32201 and a publicly disclosed Microsoft Defender elevation flaw CVE-2026-33825), plus eight CriticalCVE-2026-33825Microsoft · Microsoft Defender Antimalware PlatformSharePoint spoofing flaw CVE-2026-32201 and a publicly disclosed Microsoft Defender elevation flaw CVE-2026-33825), plus eight Critical issues.CVE-2026-35616Fortinet · FortiClientEMSFortinet released security updates for numerous products, including a critical FortiClient Enterprise Management Server (EMS) vulnerability, CVE-2026-35616, which is actively exploited in attacks.
People
Vendors
FortinetOther vendors with notable April updates include Adobe, Apple, Cisco, Fortinet, Google, Apache, and SAP.MicrosoftMicrosoft’s April 2026 Patch Tuesday fixes 167 vulnerabilities, including two zero-days (an actively exploited SharePoint spoofing flaw CVE-2026-32201 and a publicly disclosed Microsoft Defender elevation flaw
Products
FortiClient EMSFortinet released security updates for numerous products, including a critical FortiClient Enterprise Management Server (EMS) vulnerability, CVE-2026-35616, which is actively exploited in attacks.Microsoft Defender Antimalware Platformzero-days (an actively exploited SharePoint spoofing flaw CVE-2026-32201 and a publicly disclosed Microsoft Defender elevation flaw CVE-2026-33825), plus eight Critical issues.Microsoft OfficeUsers should prioritize updating Microsoft Office and Defender immediately due to multiple Office RCEs exploitable via the preview pane or malicious documents.Microsoft SharePoint ServerCVE-2026-32201 – Microsoft SharePoint Server Spoofing Vulnerability