April 2026 Patch Tuesday briefing

Executive briefing

Executive Summary

Two vulnerabilities are being actively exploited in the wild this month, both enabling spoofing-driven compromise paths across SharePoint Server and Windows Shell. April’s release includes 167 CVEs, more than double March’s 79, making this an elevated-risk month driven by volume, a sharp increase in privilege-escalation fixes, and multiple items already tracked in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The patch set is heavily Windows-centric (133 Windows CVEs, plus 111 ESU), with Elevation of Privilege (93) dominating—an indicator that attackers who gain any foothold (phishing, stolen creds, exposed services) will have many options to turn initial access into full control. In addition, a Critical remote code execution issue in Windows IKE is KEV-listed, raising the urgency for internet-facing and VPN-adjacent systems even if exploitation is not yet broadly observed.

Bottom line: Patch the two exploited spoofing CVEs immediately, then prioritize Windows privilege-escalation fixes and the KEV-listed IKE remote-code-execution issue to prevent rapid takeover after initial access.

Key Risks

CVE-2026-32201 — SharePoint Server Spoofing (actively exploited)

Actively exploited / CISA KEV deadline: 2026-04-28. This issue allows an attacker to impersonate trusted SharePoint content or identities in a way that can trick users and workflows into treating malicious activity as legitimate. In real terms, this can look like forged SharePoint pages, links, or requests that appear to come from an internal site or trusted user, enabling credential capture, session abuse, or unauthorized actions inside collaboration portals.

What the attacker needs: Remote access to the SharePoint service with no user interaction required—this is particularly dangerous for internet-published SharePoint or environments where SharePoint is reachable from partner networks. Why it matters: SharePoint often sits at the center of document access and business processes; successful spoofing can accelerate data theft, internal phishing at scale, and lateral movement by abusing trust in internal collaboration systems.

CVE-2026-32202 — Windows Shell Spoofing (actively exploited)

Actively exploited / CISA KEV deadline: 2026-05-12. This vulnerability enables attackers to make a file, shortcut, or prompt appear benign when it is not, increasing the success rate of phishing and “user-assisted” malware execution. A common real-world scenario is a user receiving a file that looks like a document or trusted installer, but Windows presents it in a misleading way—leading the user to open it and unknowingly launch malicious code.

What the attacker needs: Someone to click/open a crafted file or link (user interaction required). This is a classic enabler for initial access and is especially effective against finance, HR, and executive assistants who handle high volumes of attachments. Why it matters: Even if the vulnerability itself is “just spoofing,” it directly supports credential theft and ransomware staging by improving the attacker’s ability to get code running on endpoints.

CVE-2026-33824 — Windows IKE Service Extensions Remote Code Execution

CISA KEV deadline: 2026-08-21. This is a remote code execution risk in Windows’ Internet Key Exchange (IKE) components—meaning an attacker could potentially run code on a target system over the network. The practical scenario is exploitation against systems that expose or rely on IKE/IPsec-related services, where a crafted network exchange could lead to system compromise without needing a user to click anything.

What the attacker needs: Network reachability to the affected service (often relevant to VPN gateways, perimeter hosts, and servers with IPsec/IKE enabled). Why it matters: Remote code execution on network-facing systems is a high-leverage path to domain compromise and ransomware propagation, especially when it lands on infrastructure that already has broad network trust.

CVE-2026-33825 — Microsoft Defender Elevation of Privilege (publicly disclosed)

CISA KEV deadline: 2026-05-06. This vulnerability is publicly disclosed, increasing the likelihood of rapid weaponization. It enables an attacker who already has a foothold to gain higher privileges by abusing how access controls are enforced around Defender-related components. In real-world intrusions, this is the kind of bug used after initial access to turn a standard user or low-privilege process into an admin-level capability.

What the attacker needs: Existing access on a machine (for example, via phishing, stolen credentials, or another exploit) and the ability to run code locally—no user interaction required once they’re on the box. Why it matters: Privilege escalation is a force multiplier: it enables disabling security controls, dumping credentials, moving laterally, and accelerating ransomware deployment.

Threat Landscape

April shows a clear shift from last month: exploitation moved from zero (March) to two in-the-wild CVEs (April), while overall volume more than doubled. The exploited items are spoofing-focused, consistent with attacker tradecraft that prioritizes deception and trust abuse to gain or deepen access—especially effective when paired with phishing and internal collaboration platforms.

The broader patch mix is dominated by Elevation of Privilege (93 CVEs), reinforcing a familiar pattern: attackers don’t need a single “silver bullet” vulnerability if they can chain initial access → privilege escalation → lateral movement. With Windows and ESU accounting for the majority of fixes, organizations with large endpoint fleets and legacy systems should assume patch latency will be actively exploited by opportunistic and targeted actors alike.

Recommended Actions

1. Patch immediately (Security + Collaboration owners): CVE-2026-32201 on SharePoint Server (KEV 2026-04-28) and CVE-2026-32202 on Windows endpoints/servers (KEV 2026-05-12). Treat as active intrusion prevention, not routine hygiene.

2. Prioritize perimeter and VPN-adjacent systems (Network + Windows platform teams): Patch CVE-2026-33824 on systems where IKE/IPsec is enabled or reachable (KEV 2026-08-21). Reduce exposure by limiting inbound access to required peers only and validating firewall rules around IPsec/IKE-related traffic.

3. Close privilege-escalation paths fast (Endpoint engineering + SecOps): Accelerate deployment of Windows Elevation of Privilege fixes broadly, with special focus on admin workstations, jump boxes, and servers. These are the systems attackers target to turn a foothold into full environment control.

4. Harden against spoofing-led initial access (Security awareness + Email/Web + Endpoint teams): Reinforce controls that blunt “click-to-compromise” chains: tighten attachment handling policies, increase blocking for suspicious shortcut/archive patterns, and ensure endpoint protections are configured to warn/block deceptive file types commonly used in user-assisted execution.

5. Operationalize KEV deadlines (GRC + IT leadership): Track and enforce remediation SLAs for the KEV-listed items: 2026-04-28, 2026-05-06, 2026-05-12, and 2026-08-21—with executive visibility until closure to prevent “known exploited” exposure from becoming a reportable incident.

Technical briefing

Technical Summary

April 2026 Patch Tuesday ships 167 CVEs: 2 Critical, 125 High, 40 Medium, and 0 Low. This is a sharp month-over-month increase from 79 CVEs in March 2026 (which had 1 Critical and 0 exploited), and it arrives with 2 CVEs confirmed actively exploited plus 4 CVEs listed in CISA KEV. The release is dominated by Elevation of Privilege (93), followed by Information Disclosure (21) and Remote Code Execution (20)—a distribution consistent with post-compromise attacker objectives (privilege gain, credential/material access, and lateral movement enablement) rather than purely initial-access bugs.

What makes this month notable is the combination of (1) active exploitation of spoofing-class issues (often used to coerce user trust or misroute authentication flows), (2) a KEV-listed, unauthenticated network RCE in a core Windows service (IKE), and (3) a publicly disclosed Defender-related EoP that is well-positioned for rapid weaponization in hands-on-keyboard intrusions. Operationally, Windows/ESU volume remains the patching gravity well (Windows: 133, ESU: 111), but the exploited surface spans both SharePoint Server and Windows Shell, reinforcing that attackers are mixing server-side and endpoint deception techniques to sustain access and expand control.

Key finding: Two spoofing vulnerabilities are already being exploited in the wild, while a KEV-listed unauthenticated Windows IKE RCE represents the highest-impact “wormable-adjacent” exposure for internet-facing systems.

Critical & Exploited Vulnerabilities

CVE-2026-33824 — Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

With a Critical 9.8 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CWE-415 Double Free class, this is the month’s most dangerous “reach-and-run” condition: network-reachable, no authentication, no user interaction. In practical terms, any host exposing IKE/IPsec-related services (commonly UDP 500/4500) becomes a candidate for pre-auth remote code execution. Attackers would prioritize this for edge compromise—targeting VPN gateways, perimeter Windows servers, or misconfigured endpoints with exposed IKE—then immediately pivot to credential theft, persistence (service installation/scheduled tasks), and lateral movement.

This CVE is CISA KEV-listed with CISA KEV deadline: 2026-08-21, which should be treated as a signal of meaningful operational concern even absent confirmed exploitation in this dataset. The most realistic attack chain is: internet scan → IKE service exploit → SYSTEM-level code execution → dump LSASS/steal machine secrets → domain discovery and lateral movement. Because the vulnerability sits in a foundational networking/security service, defenders should assume exploitation attempts will be noisy at the network edge (probing) but can become quiet post-compromise once code execution is achieved.

Detection coverage: 2 GitHub PoCs available, which materially lowers the barrier for both red teams and opportunistic actors to reproduce and adapt exploit logic.

CVE-2026-26149 — Microsoft Power Apps Desktop Client Spoofing Vulnerability

This Critical 9.0 spoofing issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) maps to CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) and is best understood as a trust-manipulation primitive rather than a pure memory corruption bug. The vector indicates an attacker needs some authenticated foothold (PR:L) and user interaction (UI:R)—for example, a low-privileged user session where the victim is induced to open or interact with crafted content inside the Power Apps Desktop client. The Scope: Changed (S:C) component is the red flag: successful spoofing can cross a trust boundary, enabling actions or data access that the user did not intend.

In real-world operations, this is most likely weaponized as part of a phishing-to-internal-app pivot: an attacker with a basic account (or who has already compromised one) crafts content that misrepresents identity, destination, or action context inside the client—nudging a user to approve a workflow, disclose sensitive data, or execute a high-impact action under false pretenses. The payoff is typically credential capture, token misuse, or business-process compromise, and it pairs naturally with the month’s heavy EoP volume: spoofing to gain a better foothold, then privilege escalation to solidify control.

CVE-2026-32201 — Microsoft SharePoint Server Spoofing Vulnerability

This vulnerability is actively exploited and sits at Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) with CWE-20 Improper Input Validation. Despite the “Medium” label, the vector is operationally significant: network-reachable, no authentication, no user interaction. That combination is exactly what makes SharePoint a recurring target—attackers can probe and exploit at scale, especially where SharePoint is exposed internally to broad user populations or externally via publishing/reverse proxies.

In practice, a SharePoint spoofing flaw is commonly used to misrepresent content origin, identity, or request context, enabling follow-on actions like credential harvesting, session confusion, or misrouting users to attacker-controlled resources while appearing legitimate. In intrusions, this kind of bug often supports initial access or credential acquisition, after which attackers move quickly into SharePoint data theft, discovery of sensitive documents, and pivoting to other Microsoft services.

Actively exploited. CISA KEV deadline: 2026-04-28.
Detection coverage: 1 GitHub PoC available.

CVE-2026-32202 — Windows Shell Spoofing Vulnerability

Also actively exploited, this Windows Shell spoofing issue is scored Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) and tagged CWE-693 Protection Mechanism Failure. The key operational detail is UI:R: exploitation typically hinges on a user being tricked into interacting with a crafted file, shortcut, archive, or shell-presented object (e.g., a deceptive icon/extension/preview behavior). While the impact is “only” low confidentiality loss per the vector, the real-world value is that Shell spoofing is a reliable enabler for phishing success and execution of secondary payloads—it helps attackers get past user skepticism and security prompts.

Expect this to show up in campaigns where the attacker’s goal is to masquerade a malicious payload as a benign document or link, leading to execution via a secondary mechanism (script host, LOLBin, installer, or a browser-delivered stage). Once the user is engaged, the attacker can transition to credential theft and persistence. This CVE is particularly relevant for environments with heavy email/Teams file exchange and where file extensions are hidden or preview handlers are widely used.

Actively exploited. CISA KEV deadline: 2026-05-12.
Detection coverage: 3 GitHub PoCs available.

CVE-2026-33825 — Microsoft Defender Elevation of Privilege Vulnerability

This is a publicly disclosed High 7.8 local EoP (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) tied to CWE-1220 Insufficient Granularity of Access Control. The vector translates cleanly to a common post-compromise step: an attacker with local low privileges (often obtained via phishing, drive-by, or stolen creds) can escalate privileges without user interaction. In enterprise intrusions, this is exactly the kind of bug used to convert an unreliable foothold into SYSTEM-level control, enabling credential dumping, tamper attempts, and broad endpoint takeover.

Because it is publicly disclosed, defenders should assume rapid incorporation into offensive tooling and tradecraft, especially in environments where Defender components or management integrations are present. The most realistic chain is: initial access as standard user → exploit Defender EoP → SYSTEM → disable/evade security controls, dump creds, deploy ransomware or lateral movement tooling. Even when the end goal isn’t ransomware, SYSTEM access is a force multiplier for stealth and persistence.

Publicly disclosed. CISA KEV deadline: 2026-05-06.
Detection coverage: 5 GitHub PoCs available.

Threat Category Analysis

Elevation of Privilege (93 — ~56% of total)

EoP dominates the release, signaling Microsoft’s continued churn in hardening boundaries that attackers routinely cross after initial access. The standout in this dataset is the publicly disclosed CVE-2026-33825, which fits the classic “low-priv to SYSTEM” playbook and is likely to be paired with commodity initial-access vectors. Compared to last month’s lower volume (79 total CVEs, no exploitation), this month’s profile suggests defenders should plan for post-compromise acceleration: attackers land a foothold and then rapidly escalate to cement control.

Remote Code Execution (20 — ~12% of total)

RCE volume is meaningful, but the risk is concentrated in the Critical CVE-2026-33824 affecting Windows IKE. Its unauthenticated, no-click nature makes it the most operationally urgent RCE class this month, particularly for edge-exposed systems. Even without confirmed exploitation here, KEV inclusion and available PoCs make it a priority for both blue and red teams.

Information Disclosure (21 — ~13% of total)

Information disclosure remains a steady contributor and typically acts as an enabler: credential material, configuration secrets, or sensitive document exposure that improves attacker decision-making and lateral movement. In months where EoP is dominant, info disclosure often pairs with it—attackers first harvest what they can, then escalate privileges to access protected stores and broader telemetry.

Security Feature Bypass (12 — ~7% of total)

Security feature bypasses are disproportionately valuable in mature environments because they undermine compensating controls (mark-of-the-web behaviors, trust prompts, policy enforcement, or sandbox boundaries). While none are called out as exploited here, the category count suggests defenders should expect control-evasion attempts to remain a theme, especially when paired with Shell/user-interaction vectors like CVE-2026-32202.

Spoofing (9 — ~5% of total)

Spoofing is the most operationally visible theme this month because both exploited CVEs are spoofing: CVE-2026-32201 (SharePoint) and CVE-2026-32202 (Windows Shell). This reflects attacker preference for deception-based access and execution—tricking users or systems into trusting the wrong thing—often as a low-cost path to credentials and payload delivery.

Denial of Service (10 — ~6% of total)

DoS is present but not the operational focus given the exploited/critical set. Treat these as availability risks for specific roles (e.g., edge services, line-of-business servers), but prioritize remediation behind exploited and pre-auth RCE/EoP issues unless availability is mission-critical.

Product Impact

Windows / ESU (Windows: 133; ESU: 111)

Windows and ESU carry the bulk of the patch load and include both the highest-impact critical and an actively exploited endpoint issue. CVE-2026-33824 (IKE RCE) is the primary concern for internet-facing or perimeter-adjacent Windows systems using IPsec/IKE, while CVE-2026-32202 (Shell spoofing) is a high-frequency endpoint risk in user-heavy environments. ESU coverage matters operationally because legacy estates often have weaker compensating controls and longer patch latency—exactly where attackers focus once they identify a soft target.

Microsoft Office / SharePoint (14)

Although the Office family count is smaller, it includes an actively exploited SharePoint Server issue: CVE-2026-32201. SharePoint remains a high-value target due to its role as a document hub and its frequent integration with identity and workflow systems. Treat SharePoint patching as time-sensitive, especially where it is reachable from untrusted networks or broadly accessible internally.

System Center / Defender (1)

The single System Center item is deceptively important: CVE-2026-33825 is publicly disclosed and enables local privilege escalation. In environments where endpoint security tooling is ubiquitous, an EoP in or adjacent to Defender components can become a repeatable step in attacker playbooks to reach SYSTEM and attempt defense evasion.

Azure (5)

Azure appears in the critical set via CVE-2026-26149 (Power Apps Desktop client spoofing). While it requires user interaction and some privileges, it targets a high-trust workflow surface—where successful spoofing can translate into business process compromise and data exposure rather than traditional code execution.

Detection & Response

Immediate Detection Actions

• CVE-2026-33824: 2 GitHub PoCs available — prioritize network-based detections for anomalous IKE/IPsec negotiation patterns and repeated malformed exchanges against UDP 500/4500, especially from internet sources to servers that do not normally terminate VPN/IPsec.
• CVE-2026-32201: 1 GitHub PoC available — monitor SharePoint web logs for unusual request patterns that align with spoofing attempts (unexpected endpoints, abnormal headers/parameters, and high-rate probing from single sources).
• CVE-2026-32202: 3 GitHub PoCs available — increase scrutiny on email/web-delivered files leading to Explorer/Shell interactions followed by script/LOLBin execution.
• CVE-2026-33825: 5 GitHub PoCs available — watch for local privilege escalation behaviors shortly after initial access (sudden SYSTEM process creation from user context, service creation bursts, and security tooling configuration changes).

Hunting Guidance

• Hunt for edge exploitation and post-exploitation pivoting (targets: CVE-2026-33824): look for inbound IKE/IPsec traffic spikes followed by new service installs, suspicious scheduled tasks, or credential access attempts (e.g., LSASS access patterns) on the same host within minutes to hours.
• Hunt for SharePoint-driven credential or session abuse (targets: CVE-2026-32201): correlate unusual SharePoint requests with subsequent authentication anomalies—new sign-ins from atypical IPs, rapid access to sensitive document libraries, and sudden permission changes.
• Hunt for user-assisted execution chains (targets: CVE-2026-32202): identify sequences where explorer.exe or Shell-related processes precede execution of scripting engines or LOLBins (e.g., wscript.exe, mshta.exe, rundll32.exe, powershell.exe) originating from user download locations.
• Hunt for privilege escalation to SYSTEM (targets: CVE-2026-33825): baseline and alert on rare parent/child relationships where a user-context process spawns SYSTEM-context tooling, and on abrupt changes to endpoint security settings immediately after a low-priv foothold is established.

Priority Log Sources

• Windows Security Event Logs (process creation where available, privilege use, service installation events), plus Sysmon if deployed for richer process ancestry.
• SharePoint IIS logs / ULS logs for request-level visibility and correlation to authentication events.
• Network telemetry at the perimeter (firewall/IDS/NetFlow) focusing on UDP 500/4500 and unusual IKE negotiation patterns.
• EDR telemetry for process trees, command lines, and credential access behaviors following user interaction or edge service anomalies.

Patching Priority

Tier 1 — Immediate (Actively Exploited / KEV)

• CVE-2026-32201 — KEV deadline: 2026-04-28
• CVE-2026-33825 — KEV deadline: 2026-05-06
• CVE-2026-32202 — KEV deadline: 2026-05-12
• CVE-2026-33824 — KEV deadline: 2026-08-21

Tier 2 — High Priority

• CVE-2026-33824 — Critical, unauthenticated network RCE in Windows IKE; prioritize any host with exposed or perimeter-adjacent IPsec/IKE.
• CVE-2026-26149 — Critical spoofing with scope change; prioritize environments where Power Apps Desktop is used for high-trust workflows and where user-targeting is plausible.

Tier 3 — Standard

Focus remaining remediation on the month’s broad Windows/ESU backlog (given the heavy EoP skew), then Office/SharePoint and Developer Tools based on asset criticality and exposure. In practice: patch high-value user populations first (admins, finance, developers), then general endpoints, then lower-tier servers—while ensuring SharePoint and edge-facing Windows roles are not left behind due to maintenance-window constraints.