Microsoft Issues Patches for Share Point Zero-Day and 168 Other New Vulnerabilities

Summary: Microsoft released updates for a record 169 security flaws on Tuesday, including 157 rated Important and eight Critical, with 93 classified as privilege escalation and 21 as remote code execution. The actively exploited flaw is CVE-2026-32201, a SharePoint Server spoofing vulnerability with a CVSS score of 6.5 caused by improper input validation, which CISA added to its KEV catalog with a remediation deadline of April 28, 2026 for FCEB agencies.
Bottom line: A publicly known Defender privilege escalation flaw, CVE-2026-33825, was patched only after a researcher using the alias "Chaotic Eclipse" published the BlueHammer exploit on GitHub on April 3, 2026, following a breakdown in disclosure communications with Microsoft. Separately, CVE-2026-33824 in the Windows IKE Service carries a CVSS score of 9.8 and requires no user interaction, making internet-facing IKEv2 systems a prime candidate for rapid weaponization.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-20585 CVE-2026-21637 CVE-2026-25250 CVE-2026-32201 CVE-2026-32631 CVE-2026-33825
Related: Patch Tuesday, April 2026 Edition Cyber Risks ·
CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability Known Exploited Vulnerabilities · Apr 22, 2026
CVE-2026-32201: Microsoft Share Point Server Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Apr 14, 2026