Microsoft Patch Tuesday April 2026: 168 Flaws Fixed Including An Actively Exploited SharePoint Zero-Day—Act Now + Video

Introduction

On April 14, 2026, Microsoft released its April 2026 Patch Tuesday security update, addressing a massive 168 vulnerabilities across its product portfolio—one of the largest monthly security releases on record. The update includes fixes for one actively exploited zero-day and one publicly disclosed flaw, both of which security teams must treat as immediate priorities. The most urgent fix this month targets CVE-2026-32201, a Microsoft SharePoint Server Spoofing Vulnerability confirmed to be actively exploited in the wild, allowing unauthenticated attackers to perform spoofing attacks via improper input validation. This article provides a comprehensive technical breakdown of the vulnerabilities, step-by-step mitigation guides, and actionable security commands for both Windows and Linux environments.

Learning Objectives

Understand the technical impact of CVE-2026-32201 (SharePoint Spoofing) and CVE-2026-33825 (Defender EoP), including exploitation vectors and CVSS scoring.
Implement immediate remediation using PowerShell, Windows Update commands, and Linux-based scanning tools to detect vulnerable systems.
Apply advanced hardening techniques for SharePoint Server, Windows Defender, and network-level protections against the patched RCE flaws.

You Should Know

Deep Dive: CVE-2026-32201 – SharePoint Server Spoofing Vulnerability (CVSS 6.5, Actively Exploited)

This zero-day stems from improper input validation (CWE-20) in Microsoft Office SharePoint, allowing an unauthenticated remote attacker to perform spoofing over a network with low attack complexity and no user interaction required. Successful exploitation enables attackers to view sensitive information and modify disclosed data, impacting both confidentiality and integrity—though availability remains unaffected. Microsoft has not released technical exploitation details or indicators of compromise (IoCs), but confirmation of active exploitation suggests the flaw was already weaponized prior to patch release. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog, urging organizations to patch before April 28, 2026.

How Attackers Exploit It: By sending crafted HTTP requests to exposed SharePoint systems, attackers can inject malicious input that bypasses validation, enabling them to impersonate legitimate accounts, read confidential documents, and alter stored data. In enterprise environments where SharePoint is widely exposed internally or externally, this vulnerability presents a serious risk—especially when combined with additional weaknesses for lateral movement or data exfiltration.

Step‑by‑Step Guide: Immediate Patching and Verification

Step 1: Check Your SharePoint Version and Patch Status (Windows PowerShell)

 Run as Administrator on SharePoint Server
Get-SPFarm | Select-Object Name, BuildVersion

Check if KB5002854 (SharePoint Server 2019) is installed
Get-HotFix | Where-Object {$_.HotFixID -eq "KB5002854"}

For SharePoint Server Subscription Edition, check KB5002856
Get-HotFix | Where-Object {$_.HotFixID -eq "KB5002856"}

What this does: Identifies your SharePoint farm version and confirms whether the April 2026 security update has been applied.

Step 2: Apply the Security Update via Microsoft Update Catalog
– Download the standalone package from Microsoft Update Catalog
– SHA256 hash for sts2019-kb5002854-fullfile-x64-glb.exe: `06F19E5D71A3B58662E91C3AA3739EF53E4B677EB9DC2111C75F347C4E76A58C`

Step 3: If Running SharePoint Workflow Manager, Pre-Install Required Update

 IMPORTANT: Install KB5002799 before the cumulative update
$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.Update()
iisreset

What this does: Enables debug flags for classic Workflow Manager to ensure compatibility with the security update.

Step 4: Verify Successful Installation

 Check the build version after installation (should be 16.0.10417.20114 for 2019)
(Get-Item "C:\Program Files\Microsoft Office Servers\16.0\Bin\Microsoft.SharePoint.dll").VersionInfo.ProductVersion

Step 5: Linux-Based Network Scanning for Vulnerable SharePoint Servers

 Use Nmap to detect SharePoint servers on your network
nmap -p 80,443 --script http-sharepoint-version -sV <target-network>/24

Use Curl to test for improper input validation (educational purposes only)
curl -X POST "https://<sharepoint-server>/_api/web/lists" \
-H "Content-Type: application/json" \
-d '{"<strong>proto</strong>": {"malicious": "payload"}}' \
--insecure -v

CVE-2026-33825 – Microsoft Defender Elevation of Privilege (CVSS 7.8, Publicly Disclosed)

This zero-day allows a local attacker to escalate privileges to SYSTEM, effectively giving them complete control over the affected system. The vulnerability stems from insufficient access-control granularity in Windows Defender, where security policies are too broad, allowing authorized users to perform actions beyond their intended permissions. Once at SYSTEM level, an attacker can disable security tools, install persistent malware, harvest credentials, and move laterally to other systems. Microsoft mitigated this issue through the Microsoft Defender Antimalware Platform update version 4.18.26050.3011, which is automatically delivered to supported systems.

Step‑by‑Step Guide: Verify and Remediate Defender EoP Vulnerability

Step 1: Check Current Defender Platform Version (Windows Command Line)

 Run as Administrator
cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -GetPlatformVersion

Expected output should be `4.18.26050.3011` or higher.

Step 2: Force Defender Platform Update if Auto-Update Failed

 PowerShell method
Update-MpSignature
Start-MpScan -ScanType QuickScan

Alternative: Download definitions manually from https://www.microsoft.com/en-us/wdsi/definitions

Step 3: Verify Defender Service Integrity

 Check if Defender services are running with correct privileges
Get-Service -Name WinDefend, Mpssvc | Select-Object Name, Status, StartType

Review Defender event logs for privilege escalation attempts
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-Windows Defender/Operational"; ID=1116,1117} | Format-List

Step 4: Enable Defender Tamper Protection (Critical for Prevention)

 Set-MpPreference -DisableRealtimeMonitoring $false (ensures protection is active)
Set-MpPreference -EnableControlledFolderAccess Enabled
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled

What this does: Enables Attack Surface Reduction (ASR) rules to block common exploit techniques used after privilege escalation.

Critical RCE Vulnerabilities: Network-Level Exploits Without User Interaction

Among the eight Critical-rated flaws, all but one are Remote Code Execution (RCE) vulnerabilities, underscoring the severity of this month‘s release:

|–|–||-|

The Windows TCP/IP RCE (CVE-2026-33827) is particularly alarming—described as a race condition allowing attackers to execute arbitrary code over the network. Similarly, the Active Directory RCE can be exploited at the network level without user interaction in certain configurations.

Step‑by‑Step Guide: Network Hardening and Patch Deployment

Step 1: Deploy All Critical RCE Patches via WSUS or PowerShell

 Install all missing critical updates using PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force
Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot -Category "Critical Updates"

Or use the built-in Windows Update command
Start-Process "ms-settings:windowsupdate-action"

Step 2: Block Malicious RDP Connections (Windows Firewall)

 Block inbound RDP from untrusted networks
New-NetFirewallRule -DisplayName "Block RDP from Public" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block -RemoteAddress "0.0.0.0/0"

Restrict RDP to specific IP ranges
Set-NetFirewallRule -DisplayName "Remote Desktop" -RemoteAddress "192.168.1.0/24"

Step 3: Disable Unnecessary IKE Services (If Not Using VPN)

 Check IKE service status
Get-Service -Name IKExt

Disable IKE service if not required
Stop-Service -Name IKExt -Force
Set-Service -Name IKExt -StartupType Disabled

Step 4: Linux-Based Active Directory RCE Detection Script

!/bin/bash
 Scan for vulnerable Active Directory servers (CVE-2026-33826)
nmap -p 389,636,3268,3269 --script ldap-rootdse <ad-server-ip>

Test for improper LDAP input validation (educational)
ldapsearch -x -H ldap://<ad-server> -b "dc=domain,dc=com" -D "cn=admin,dc=domain,dc=com" -w "password" "(objectClass=)"

Microsoft Office RCEs: Document-Based Attacks via Preview Pane

Two separate RCE flaws in Microsoft Word (CVE-2026-33114, CVE-2026-33115) and one in Office (CVE-2026-32190) can be executed via the preview pane or by opening malicious documents. This makes them particularly dangerous for organizations that rely on email attachments or shared document repositories.

Step‑by‑Step Guide: Office Hardening and Mitigation

Step 1: Enable Protected View and Block Macros via Group Policy

 PowerShell to configure Office security
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security" -Name "ProtectedView" -Value 1
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security" -Name "VBAWarnings" -Value 4

Step 2: Disable Preview Pane in Outlook (Temporary Mitigation)

 Disable Outlook Preview Pane for all users
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\Options\Reading" -Name "PreviewPane" -Value 0

Step 3: Linux Command to Scan for Malicious Office Documents

 Use olevba (from oletools) to detect suspicious macros
olevba --decode --deobf malicious.docm

Use exiftool to check document metadata
exiftool -All suspicious.docx | grep -i "creator|author|lastmodified"

Cloud and Azure Hardening: Azure Monitor Agent and Logic Apps

The April 2026 update includes patches for Azure Monitor Agent and Azure Logic Apps, both of which are critical for hybrid and cloud-only environments. Unpatched agents can be exploited to gain unauthorized access to Azure resources.

Step‑by‑Step Guide: Azure Patch Verification

Step 1: Check Azure Monitor Agent Version (Azure CLI)

az vm extension list --vm-name <vm-name> --resource-group <rg> --query "[?type=='AzureMonitorWindowsAgent'].version"

Step 2: Force Azure Agent Update

 Update Azure Monitor Agent via PowerShell on Windows VMs
Invoke-AzVMRunCommand -ResourceGroupName <rg> -VMName <vm> -CommandId 'RunPowerShellScript' -ScriptPath 'Update-AzureMonitorAgent.ps1'

Step 3: Audit Azure Logic Apps for Unpatched Workflows

 List all Logic Apps and check last modified date
Get-AzLogicApp | Select-Object Name, ResourceGroupName, Version, ProvisioningState

What Undercode Say

Immediate action is non-negotiable. With CVE-2026-32201 actively exploited in the wild and CISA‘s April 28 deadline looming, delaying patching invites a breach. SharePoint remains a crown jewel for attackers—every unpatched server is a potential data exfiltration point.
Layered defense is the only viable strategy. Patching alone won’t save you. Implement the commands above: block unnecessary services (IKE, RDP from public networks), enforce Defender Tamper Protection, and deploy network segmentation to limit lateral movement. The Windows TCP/IP RCE and Active Directory RCE are network-based—firewall rules and IDS/IPS signatures are your second line of defense.
Automate, don’t manualize. The scale of this release (168 flaws) makes manual patching impossible in enterprise environments. Use PSWindowsUpdate, WSUS, or Azure Update Management to ensure coverage across thousands of endpoints. And remember: the Defender EoP fix is automatic only if Windows Update is configured correctly—verify platform version 4.18.26050.3011 manually.

Prediction

The April 2026 Patch Tuesday marks a turning point in Microsoft’s vulnerability landscape. With 93 elevation of privilege flaws (57% of all patches), attackers are shifting focus from remote exploitation to post-compromise privilege escalation—suggesting that initial access vectors (phishing, drive-by downloads) remain successful, but the real damage happens after SYSTEM-level access is achieved. Expect to see weaponized exploit chains combining CVE-2026-32201 (spoofing) with CVE-2026-33825 (EoP) in the coming weeks, allowing attackers to move from SharePoint to full domain compromise. Organizations that fail to patch by the CISA deadline will likely face ransomware incidents leveraging these flaws. Additionally, the record-breaking 247 total vulnerabilities (including Edge Chromium issues) signals that Microsoft’s attack surface is expanding faster than ever—security teams must adopt continuous vulnerability management rather than monthly firefighting.

▶️ Related Video (78% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Cybersecuritynews Microsoft – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post