Patch Tuesday April 2026: what Microsoft shipped

Microsoft published its security updates on Tuesday, 14 April 2026.

On the day, the briefing reads Microsoft's advisories and this page lists what carried a flag. It stays here afterwards as the record.

Which flaws were flagged?

2 flagged by Microsoft as exploited at release.

One flagged by Microsoft as publicly disclosed.

3 are in the CISA KEV catalog.

CVE-2026-32201 Microsoft SharePoint Server Spoofing Vulnerability Exploited at release · In KEV
CVE-2026-32202 Windows Shell Spoofing Vulnerability Exploited at release · In KEV
CVE-2026-33825 Microsoft Defender Elevation of Privilege Vulnerability Publicly disclosed · In KEV

Ransomware Persona Masks MuddyWater Espionage Operation (2026-05-07)
ShadowPad Espionage Campaign Targets Exchange and IIS Servers (2026-05-05)
Exchange N-day Abuse Expands Espionage Reach Across Governments (2026-05-03)
Deep#Door Turns Windows Hosts Into Stealthy Spyware Nodes (2026-05-02)
No-Code Phishing Pages Reclaim Exchange Credentials (2026-05-01)
RPC Architecture Lets Impersonating Processes Reach SYSTEM (2026-04-28)
Teams Trust Turned Into Browser Persistence (2026-04-27)
Kyber Turns ESXi and Windows Into One Blackout (2026-04-22)
Ransomware Crew Arms Affiliates for Cross-Platform Datacenter Hits (2026-04-21)
Formbook Phishing Adds Redundant Delivery Paths (2026-04-20)
Defender’s file rewrite turns patched PCs into SYSTEM targets (2026-04-18)
Metasploit Adds Public RCE Modules for Web Apps (2026-04-18)

March 2026: 2 flagged.

February 2026: 6 flagged.

We hold 15 CVEs from Microsoft's 2026-Apr document. That is what our records reach, not the size of the release: it grows for weeks after the day.