Image generated by Google Gemini
Microsoft’s April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company’s largest monthly security updates.
Microsoft on Tuesday pushed out what security researchers are calling the second-largest monthly security update in the company’s history, patching 165 vulnerabilities, including two zero-days.
The sheer size of this month’s release raised eyebrows immediately. Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, noted in a blog post that the release rivals the record set in October 2025.
Microsoft has offered no public explanation for the surge in volume, but Childs pointed to a growing trend: “Our incoming rate has essentially tripled, making triage a challenge, to say the least,” he wrote, attributing much of the increase to vulnerability reports generated with AI tools.
The more urgent of the two zero-days is a SharePoint Server spoofing flaw, tracked as CVE-2026-32201, carrying a CVSS score of 6.5. Microsoft described the issue as improper input validation that lets an unauthenticated attacker perform spoofing over a network, potentially reading sensitive information and altering disclosed data.
The second zero-day, CVE-2026-33825, was present in Microsoft Defender and was publicly known before today’s patch. The privilege escalation bug can hand an attacker full SYSTEM-level access. Security researcher Jack Bicer of Action1 told TechRepublic that once this foothold is established, “it allows full control over endpoints, enabling data exfiltration, disabling security tools, and lateral movement across networks.”
Proof-of-concept exploit code for the flaw, nicknamed BlueHammer by the researcher who posted it to GitHub early this month, is already in the wild. Users can push the Defender fix manually via Windows Security → Virus & threat protection → Protection Updates → Check for updates.
Of the eight vulnerabilities Microsoft rated Critical this month, seven involve remote code execution, and one is a denial-of-service issue.
The standout is CVE-2026-33824, a flaw in the Windows Internet Key Exchange extension scoring a near-perfect 9.8 on the CVSS scale. An unauthenticated attacker can exploit it by sending crafted packets to any Windows machine running IKE version 2. For organisations that cannot patch immediately, Microsoft recommends blocking inbound traffic on UDP ports 500 and 4500.
Also flagged as critical: a race condition in Windows TCP/IP (CVE-2026-33827) that could allow remote code execution via specially crafted IPv6 packets against machines with IPSec enabled, and a flaw in Windows Active Directory (CVE-2026-33826), though that one requires the attacker to already be inside the same restricted Active Directory domain as the target.
Microsoft Office users face multiple remote code execution bugs in Word and Excel, some of which can be triggered simply by previewing a malicious document in the preview pane. Security teams should treat Office patching as a high priority, particularly for users who regularly open email attachments.
Beyond security, the update bundles a handful of quality-of-life improvements for Windows 11:
For Windows 11 users on versions 25H2 and 24H2, the update lands as KB5083769, bringing devices to build 26200.8246 or 26100.8246, respectively. It downloads automatically through Windows Update.
Also read: Microsoft’s April security update lands as researchers warn that the EngageLab Android SDK vulnerability could expose millions of Android users to malware delivery.
Aminu Abdullahi is a B2C and B2B technology and finance writer with more than six years of experience covering enterprise IT, cybersecurity, cloud computing, artificial intelligence, fintech, business software, and emerging technologies. His work has appeared in publications including TechRepublic, eWEEK, Channel Insider, Geekflare, Enterprise Networking Planet, eSecurity Planet, CIO Insight, and Webopedia. With a technical background in computer science, he specializes in translating complex technology topics into clear, accessible content for business leaders and decision-makers.
