InfoSecBulletin Cybersecurity for mankind
Microsoft’s April 2026 security update has fixed 167 flaws in its products. This update includes 2 serious zero-day threats and another flaw that needs urgent attention from organizations.
Zero-Day Under Active Exploitation
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The main flaw this month is CVE-2026-32201, a flaw in Microsoft SharePoint Server that is being actively used for attacks.
This flaw is rated as Important. It lets attackers trick SharePoint users. This is a big risk for companies using SharePoint for documents and teamwork. Security teams should apply the fix right away, as it has already been used in attacks.
CVE-2026-33825 is a Microsoft Defender security issue that was shared with the public before this update. No one has used this problem yet, but since people can easily find information about it, the chance of someone misusing it soon is higher. This makes fixing it very important.
Of the 168 vulnerabilities patched this month, the distribution by attack type is as follows:’
| Impact | Count |
|---|---|
| Elevation of Privilege | 93 |
| Information Disclosure | 21 |
| Remote Code Execution | 20 |
| Security Feature Bypass | 13 |
| Denial of Service | 10 |
| Spoofing | 8 |
| Tampering | 2 |
| Defense in Depth | 1 |
| Total | 168 |
Critical RCE Vulnerabilities Patched
Among the eight Critical-rated flaws, seven are Remote Code Execution (RCE) vulnerabilities. This shows how serious this month’s updates are.
CVE-2026-33827: Windows TCP/IP Remote Code Execution Vulnerability
CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability
CVE-2026-33824: Windows Internet Key Exchange (IKE) Service Extensions RCE
CVE-2026-33115 & CVE-2026-33114: Microsoft Word Remote Code Execution (two separate flaws)
CVE-2026-32190 :Microsoft Office Remote Code Execution Vulnerability
CVE-2026-32157: Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-23666: .NET Framework Denial of Service Vulnerability (Critical-rated)
The Windows TCP/IP and Active Directory RCE issues are very concerning because attackers can use them over the network without needing anyone to do anything in some setups.
This month, there are updates for many Microsoft products and services. These include Windows Kernel (several EoP issues), Windows Print Spooler, Windows LSASS, Windows Hyper-V, Remote Desktop Licensing Service, Azure Monitor Agent, Azure Logic Apps, Microsoft SQL Server, SharePoint Server, PowerShell, GitHub Copilot, and Visual Studio Code.
The Windows UPnP Device Host got many EoP updates, showing stronger security for Windows networking systems.
Security and IT teams should take the following steps immediately:
To Prioritize CVE-2026-32201 (SharePoint) as an emergency patch given confirmed exploitation
To Address CVE-2026-33825 (Microsoft Defender) due to its public disclosure status
To Deploy all Critical-rated RCE patches, particularly for Windows TCP/IP, Active Directory, and Remote Desktop Client
To Review and patch .NET Framework and Office components to block local and document-based attack vectors
To Audit systems for WSUS and BitLocker bypass vulnerabilities (CVE-2026-32224, CVE-2026-27913), which could undermine update delivery and disk encryption integrity.
Security teams need to install all patches from April 2026 right away, especially for CVE-2026-32201.
