Microsoft Patch Tuesday: Fixes for Zero-Day Exploits & Critical Flaws

Top Summary

• What happened: Microsoft released its April Patch Tuesday update, including fixes for two zero-day vulnerabilities and multiple critical issues.
• Why it matters: The zero-day flaws are already being exploited, posing immediate risks of data theft and system compromise.
• What changes for people: Security teams must prioritize patching, especially for internet-facing SharePoint servers and vulnerable Chromium browsers.
• Who is affected: Organizations using Microsoft SharePoint, Defender, Chromium-based browsers, and other affected Windows products are at risk.

Massive Patch Tuesday Update

Microsoft's April Patch Tuesday update is one of the largest in history, addressing over 160 distinct issues. TrendAI's Dustin Childs described the scope as "monstrous." The update includes fixes for third-party and Chromium releases, totaling almost 250.

Action1's Jack Bicer emphasizes immediate attention due to the high volume of patches, zero-days, and critical issues.

SharePoint XSS Zero-Day (CVE-2026-32201)

The first zero-day vulnerability, CVE-2026-32201, is a spoofing vulnerability in Microsoft SharePoint Server leading to cross-site scripting (XSS). It is known to be exploited in the wild.

The root cause is an input validation failure. Attackers can inject malicious scripts via improperly sanitized input fields.

Automox's Mat Lee warns that the CVSS score of 6.5 understates the risk because no authentication or special privileges are needed. External threats can target internet-facing SharePoint instances directly.

"A successful XSS exploit gives attackers a path deeper into your environment," said Lee.

SharePoint Mitigation Steps

• Patch immediately.
• Audit SharePoint exposure, prioritizing on-prem instances accessible from the public internet.
• Review content security policy (CSP) headers.
• Monitor authentication logs for strange behavior.

Defender EoP Zero-Day (CVE-2026-33825)

The second zero-day, CVE-2026-33825, is an elevation of privilege (EoP) flaw in Microsoft Defender. It has been publicly disclosed but is not yet thought to have been exploited.

Bicer explains that this flaw stems from insufficient granularity in access control. It allows a local attacker with low privileges to gain SYSTEM-level access.

"What starts as a foothold can quickly become full system domination," he said.

Exploiting this vulnerability could allow attackers to take full control of endpoints, steal data, and disable security tools.

Chromium RCE Zero-Day (CVE-2026-5281)

The April update also addresses CVE-2026-5281, a remote code execution (RCE) issue affecting Chromium browsers. This flaw arises from a use-after-free condition in Google Dawn WebGPU and has been added to CISA's KEV catalog.

Action1's Gene Moody notes that browser-based vulnerabilities are highly dangerous. He emphasizes the need for immediate patching to protect users from actively exploited flaws.

"Delaying patching in this context is equivalent to knowingly allowing users to operate in a hostile environment with degraded defenses," said Moody.

Critical RCE and DoS Vulnerabilities

The update includes eight flaws rated as critical. These include:

• CVE-2026-23666: DoS issue in .NET framework
• CVE-2026-32157: RCE issue in Remote Desktop Client
• CVE-2026-32190: RCE issue in Microsoft Office
• CVE-2026-33114: RCE issue in Microsoft Word
• CVE-2026-33115: RCE issue in Microsoft Word
• CVE-2026-33824: RCE issue in Windows IKE Service Extensions
• CVE-2026-33826: RCE issue in Windows Active Directory (AD)
• CVE-2026-33827: RCE issue in Windows TCP/IP

What to Watch Next

Security researchers will continue to analyze these vulnerabilities and develop proof-of-concept exploits. Organizations should closely monitor threat intelligence feeds for new developments and ensure timely patching to mitigate potential risks.