167 Vulnerabilities, One Actively Exploited Zero-Day: What April's Patch Tuesday Means for Your Business

Every second Tuesday of the month, Microsoft does something that most software companies don’t — it publishes a transparent, detailed accounting of every security vulnerability it’s found and fixed across its entire product suite. No hiding, no minimizing. Just a public list, a patch, and a clear signal to the security community to act.

April’s release is one of the biggest of the year: 167 vulnerabilities addressed, 8 rated Critical, and two zero-days. One of those zero-days is actively being exploited in the wild right now.

As a Microsoft partner, this is the kind of release we track closely — and it’s one that every business running Microsoft technology should understand before the week is out.

What Patch Tuesday Actually Is (and Why It Matters)

Patch Tuesday isn’t a sign that Microsoft’s products are broken. It’s the opposite — it’s a disciplined, monthly security cadence that gives IT teams a predictable window to assess, test, and deploy fixes across their environments. Microsoft invests more in security research and vulnerability disclosure than almost any company in the world, and that shows up in the transparency of these releases.

The risk isn’t Microsoft finding vulnerabilities. The risk is businesses not acting on the patches once they’re available.

This month, the window for action is tighter than usual.

The Zero-Day That’s Already Being Exploited

CVE-2026-32201 is a spoofing vulnerability in Microsoft SharePoint Server. Unlike most vulnerabilities on the Patch Tuesday list — where “exploitation is possible” — this one is confirmed active. Threat actors are using it right now against unpatched SharePoint environments.

SharePoint is the backbone of document management and team collaboration for businesses across every industry. The flaw allows attackers to view sensitive information or modify data in unpatched environments. Microsoft has the fix available. The patch exists. Deployment is the only remaining variable.

The second zero-day, CVE-2026-33825, affects Microsoft Defender and allows privilege escalation to SYSTEM level — essentially full machine control. This one was publicly disclosed before the patch dropped, meaning technical details had already circulated before businesses had a way to defend against it. Microsoft moved quickly to get the fix into this month’s release.

The Critical Vulnerabilities IT Teams Need to Prioritize

Among the 8 Critical-rated flaws, nearly all are Remote Code Execution vulnerabilities — an attacker running code on your systems without touching them. The ones with the broadest enterprise exposure:

Windows Internet Key Exchange — CVE-2026-33824 scored a 9.8 out of 10 on the severity scale. Unauthenticated attackers can exploit this remotely by sending crafted packets. No login required. Microsoft has published firewall mitigations for environments that can’t patch immediately.

Windows TCP/IP RCE — CVE-2026-33827 can be exploited without any user interaction. On systems with IPv6 and IPSec enabled, the nature of the flaw means it could spread without a user doing anything wrong.

Windows Active Directory RCE — CVE-2026-33826 targets the directory service that controls network access across your entire organization. A remote code execution flaw here is high priority for any business running an on-premises or hybrid Active Directory environment.

Microsoft Word and Excel RCE — Two separate flaws in Office applications that can be triggered by opening a malicious file, or in some cases, just previewing one. For teams that handle external documents regularly, this is a practical, everyday risk.

Why the Timing Matters

There’s a predictable pattern that follows every Patch Tuesday, known in the security industry as “Exploit Wednesday.” Once patches are released, threat actors begin reverse-engineering them to understand exactly what was fixed — and to build working exploits targeting organizations that haven’t patched yet. The gap between patch release and active exploitation shrinks every year.

This month, with one zero-day already confirmed in the wild and a second publicly disclosed before the patch released, that window is already open.

Other Vendors With Urgent Updates This Month

Microsoft isn’t the only one with critical patches this cycle. April brought significant updates across the ecosystem:

Adobe released emergency fixes for Acrobat Reader and Acrobat, including an actively exploited zero-day. If your team handles PDF workflows — and most do — this update is equally time-sensitive.

Fortinet patched a critical vulnerability in FortiClient Enterprise Management Server (CVE-2026-21643), which allows unauthenticated command execution. CISA set today, April 16, as the patching deadline for federal agencies. If Fortinet is in your environment, this isn’t a next-week item.

Apache fixed a remote code execution vulnerability in Apache ActiveMQ Classic that had gone undetected for 13 years — a good reminder that even mature, stable infrastructure needs regular vulnerability review.

Recommended Priority Order for This Month

For businesses managing their own IT, here’s how we’d sequence April’s patches:

1. SharePoint Server — patch immediately, prioritize internet-facing deployments
2. Microsoft Defender — updates automatically through Windows Security, but verify the version is current
3. Word and Excel — high priority for any team handling external documents
4. Windows TCP/IP and Active Directory — server-side priority, especially in hybrid environments
5. Adobe Acrobat — urgent for document-heavy workflows
6. Fortinet FortiClient EMS — if in your environment, today is the deadline

What It Means to Have a Microsoft Partner Managing Your IT

As a Microsoft partner, centrexIT has direct access to Microsoft’s security ecosystem, partner advisories, and technical resources that go beyond what’s publicly available. When a Patch Tuesday drops — especially one of this scale — we’re not starting from scratch. We’re working from a position of deep familiarity with Microsoft’s products, update cadence, and the specific risks each release carries for the businesses we support.

For clients on our manageIT and guardIT programs, patch management is built into your service. You don’t need to read the CVE list. You don’t need to figure out the priority order. You have a team that’s already on it, with the Microsoft partnership to back it up.

If you’re managing Microsoft environments in-house and want a second opinion on where you stand after this release — or if you’re wondering whether your current IT setup is actually keeping pace with the threat environment — that’s a conversation we’re glad to have.

The bottom line: 167 vulnerabilities is significant. One actively exploited zero-day means the clock is already running. Microsoft’s Patch Tuesday process is working exactly as designed — the question is whether your patching process is too.

Talk to our team about your Microsoft environment →