Microsoft Fixes 165 Flaws, Including Exploited SharePoint Zero-Day
Summary
Microsoft’s April 2026 updates fix 165 vulnerabilities, including the reportedly exploited SharePoint zero-day CVE-2026-32201. CISA added it to its KEV catalog and set an April 28 patch deadline for federal agencies.
Key points
- Microsoft says SharePoint Server flaw CVE-2026-32201 is an input-validation spoofing vulnerability rated Important, with a CVSS score of 6.5.
- The flaw is reported as exploited in the wild; the article says the attackers and their motivation are unknown.
- CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalog and instructed federal agencies to patch it by April 28.
- Nineteen other Microsoft-patched vulnerabilities were rated “exploitation more likely.”
- Microsoft says CVE-2026-33825, a Defender privilege-escalation flaw, was publicly disclosed before patches; it is believed to be the vulnerability called BlueHammer.
- The release was described as Microsoft’s second-largest Patch Tuesday, with 165 fixes, just below the October 2025 record.
- Adobe also patched more than 50 vulnerabilities across 11 products.
Article Details
- Event Type
- Microsoft released Patch Tuesday updates addressing 165 vulnerabilities, including an actively exploited SharePoint Server zero-day.
- Impact
- CVE-2026-32201 is a spoofing vulnerability that Microsoft says could let an unauthorized attacker access and alter sensitive information over a network. Microsoft also patched CVE-2026-33825, a Microsoft Defender privilege-escalation vulnerability publicly disclosed before patches were released; it is believed to be the flaw dubbed BlueHammer. The updates also address vulnerabilities in Adobe products.
CVE
CVE-2026-32201Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreThe exploited SharePoint Server vulnerability is tracked as CVE-2026-32201 and it has been described as a spoofing issue.CVE-2026-33825Microsoft · Microsoft Defender Antimalware PlatformOne of these vulnerabilities is CVE-2026-33825, a Microsoft Defender privilege-escalation issue that the tech giant says was publicly disclosed before patches were released.
People
Vendors
Products
Microsoft Defender Antimalware PlatformOne of these vulnerabilities is CVE-2026-33825, a Microsoft Defender privilege-escalation issue that the tech giant says was publicly disclosed before patches were released.SharePoint ServerThe exploited SharePoint Server vulnerability is tracked as CVE-2026-32201 and it has been described as a spoofing issue.