Microsoft Patch Tuesday for April 2026

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Microsoft SharePoint Server contains an improper input validation flaw (CWE-20) that can be triggered by an unauthenticated, network-based attacker submitting crafted input to the server. Successful exploitation allows the attacker to perform spoofing over the network, impersonating a trusted user or source within SharePoint; detailed impact mechanics have not been published and no CVSS score or public proof-of-concept is available. Any organization running on-premises Microsoft SharePoint Server is potentially affected, and the available data does not specify affected version ranges. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2026-04-14, indicating evidence of active exploitation, and EPSS assigns a 42.8% probability of exploitation within 30 days (99th percentile). Ransomware association is currently unknown.

Do: Apply Microsoft's security updates for SharePoint Server per the vendor advisory as soon as possible, and identify your SharePoint Server versions and builds since specific affected ranges are not provided here. Given the KEV listing, federal agencies must apply the vendor mitigations, follow applicable BOD 22-01 cloud guidance, or discontinue use by the established deadline. Until patched, limit network exposure of SharePoint servers and review authentication and access logs for signs of impersonation or spoofing activity.

A protection mechanism in the Windows Shell fails (CWE-693), allowing an unauthorized attacker to perform spoofing against the shell over a network. Per the CVSS vector, the attack is network-based, requires no privileges or special conditions, but does require the targeted user to interact with attacker-supplied content. The impact is limited to confidentiality: an attacker can misrepresent information presented through the Windows Shell, gaining a spoofing foothold rather than code execution, privilege escalation, or persistence. Any organization running the affected Windows 10, Windows 11, or Windows Server builds is exposed, which effectively means most Windows estates. Microsoft has confirmed active exploitation, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-28, and a fix shipped in Microsoft's April 2026 Patch Tuesday release.

Do: Apply Microsoft's April 2026 security updates to all affected Windows 10, Windows 11, and Windows Server hosts as a priority; the flaw is on CISA's KEV catalog, so U.S. federal agencies must patch within BOD 22-01 timelines or apply vendor-recommended mitigations. Until patched, note that exploitation requires user interaction with spoofed shell content, so user awareness about verifying shell-rendered information is a partial mitigations. No public PoC is known, but confirmed in-the-wild exploitation warrants prioritizing user-facing and internet-reachable systems for patching.

A double-free memory-corruption flaw (CWE-415) in the Microsoft Windows Internet Key Exchange (IKE) service extension allows a remote, unauthenticated attacker to trigger the bug with crafted network traffic, with no privileges or user interaction required. Successful exploitation yields remote code execution with full system impact, reflected in the critical 9.8 CVSS score (high confidentiality, integrity, and availability). The vulnerable IKE component is present in Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, and 2022 (including 23H2), which ship it as a built-in feature. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-18, and security reporting confirms it is being actively exploited in the wild, though ransomware use is not yet confirmed. No public proof-of-concept is known, but the high EPSS score (72.7%, 99th percentile) signals a very strong likelihood of imminent or ongoing exploitation.

Do: Apply Microsoft's security updates for CVE-2026-33824 to all affected Windows 10, Windows 11, and Windows Server releases, prioritizing internet-exposed systems where IKE/VPN is reachable (UDP 500/4500), per BOD 26-04 requirements. Organizations unable to patch promptly should restrict or discontinue use of exposed IKE/VPN services on affected hosts until updated. Triage VPN endpoints and remote-access servers for crashes or suspicious IKE traffic given confirmed in-the-wild exploitation.

CVE-2026-33825 is an insufficient granularity of access control flaw (CWE-1220) in Microsoft Defender Antimalware Platform that allows an authorized attacker to elevate privileges locally. It is triggered by an attacker who already holds a low-privileged foothold on a machine running Defender, with no user interaction required. Successful exploitation has high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8), granting elevated local rights that facilitate defense evasion, persistence, or ransomware activity. Any organization running Microsoft Defender on Windows endpoints and servers is potentially affected. The flaw is actively exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-22 with ransomware use confirmed, and is one of three Microsoft Defender zero-days reported as exploited, two of which were still unpatched at the time of reporting.

Do: Apply Microsoft's April 2026 Patch Tuesday updates for the Defender Antimalware Platform (platform/security intelligence updates) per vendor instructions, consistent with CISA BOD 22-01 timelines for KEV entries, and note reports that two of the three exploited Defender zero-days were still unpatched, so monitor for follow-up fixes. Prioritize patching internet-reachable and high-value Windows hosts, and hunt for signs of local privilege escalation and ransomware precursor activity on systems that cannot be updated immediately.