Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities

Microsoft released patches for 169 security vulnerabilities in the largest Patch Tuesday event of the year, with one actively exploited zero-day vulnerability in SharePoint Server.

• •CVE-2026-32201 is a SharePoint spoofing vulnerability (CVSS 6.5) allowing attackers to manipulate trusted content presentation and spoof network communications, currently under active exploitation
• •Of 169 flaws, 157 are rated Important and 8 Critical, with privilege escalation vulnerabilities comprising 93 cases (57% of April patches) dominating the Patch Tuesday cycle
• •CVE-2026-33824 is a critical remote code execution in Windows IKE Service Extensions (CVSS 9.8) requiring no user interaction, posing severe risk to internet-facing VPN systems and IPsec infrastructure
• •CVE-2026-33825 is a privilege escalation in Microsoft Defender (CVSS 7.8) exploiting inadequate granular access controls, though automatic updates by default mitigate exploitation