Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

Today is Microsoft’s April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

This Patch Tuesday also addresses eight “Critical” vulnerabilities, 7 of which are remote code execution flaws and the other is a denial of service flaw.

The number of bugs in each vulnerability category is listed below:

• 93 Elevation of Privilege Vulnerabilities
• 13 Security Feature Bypass Vulnerabilities
• 20 Remote Code Execution Vulnerabilities
• 21 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 9 Spoofing Vulnerabilities

When GeekFeed reports on Patch Tuesday security updates, we only count those released by Microsoft today.

Therefore, the number of flaws does not include Mariner, Azure, and Bing flaws that were fixed by Microsoft earlier this month. There were also 80 Microsoft Edge/Chromium flaws that were fixed by Google.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5083769 & KB5082052 cumulative updates and the Windows 10 KB5082200 extended security update.

2 zero-days and Microsoft Office flaws

This month’s Patch Tuesday fixes two zero-day vulnerabilities, with one publicly disclosed and the other actively exploited in attacks.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The actively exploited zero-day flaw is:

CVE-2026-32201 – Microsoft SharePoint Server Spoofing Vulnerability

Microsoft has patched a Microsoft SharePoint Server Spoofing Vulnerability that was exploited in attacks.

“Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network,” explains Microsoft.

“An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability),” continued Microsoft.

Microsoft has not disclosed how this vulnerability was exploited in attacks or who disclosed it.

The publicly disclosed zero-day is:

CVE-2026-33825 – Microsoft Defender Elevation of Privilege Vulnerability

Microsoft has patched a Microsoft Defender privilege elevation flaw that gives SYSTEM privileges.

The company has addressed the flaw in the Microsoft Defender Antimalware Platform update version 4.18.26030.3011, which will automatically be downloaded to systems.

Windows users can manually install it by going to Windows Security > Virus & threat protection > Protection Updates, then clicking Check for updates.

Microsoft has credited Zen Dodd and Yuanpei XU (HUST) with Diffract with discovering this flaw.

Microsoft has also fixed multiple remote code execution bugs in Microsoft Office (Word and Excel) that can be executed via the preview pane or by opening malicious documents.

Therefore, users should prioritize updating Microsoft Office as soon as possible, especially if they commonly receive attachments.

The April 2026 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the April 2026 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.