Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities

Summary: Microsoft's April 2026 security update covers 165 vulnerabilities, eight of them rated critical, including a .NET denial-of-service flaw (CVE-2026-23666), a use-after-free in the Remote Desktop Client (CVE-2026-32157), and a double free in the Windows IKE extension (CVE-2026-33824) that an unauthenticated attacker can trigger with crafted packets to a machine with IKEv2 enabled. Cisco Talos also flags CVE-2026-32201, an important SharePoint input-validation flaw allowing spoofing, as already exploited in the wild, and is releasing Snort rules to detect attempts against some of the patched issues.
What's compelling: One of the 165 flaws is already being exploited in the wild, and CVE-2026-33824 needs no credentials at all - just crafted packets to a Windows host with IKEv2 enabled, which Talos says can be mitigated by blocking inbound UDP ports 500 and 4500 where IKE is not in use.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-0390 CVE-2026-23666 CVE-2026-26151 CVE-2026-26169 CVE-2026-26173 CVE-2026-26177 CVE-2026-26182 CVE-2026-27906 CVE-2026-27908 CVE-2026-27909 CVE-2026-32157 CVE-2026-32190 CVE-2026-32201 CVE-2026-33114 CVE-2026-33115 CVE-2026-33824 CVE-2026-33826 CVE-2026-33827
Related: CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026
CVE-2026-32201: Microsoft Share Point Server Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Apr 14, 2026
Microsoft Issues Patches for Share Point Zero-Day and 168 Other New Vulnerabilities Cyber Risks ·