Microsoft Patches 160+ Vulnerabilities in April 2026 Update

Microsoft released security updates on Tuesday addressing more than 160 vulnerabilities across its products, including an actively exploited zero-day flaw in SharePoint Server and another publicly disclosed issue in Microsoft Defender. The April 2026 Patch Tuesday update, one of the largest in the company's history, covers Windows, Office, and other components, with patches available for all supported versions.

The most urgent fix targets CVE-2026-32201, a spoofing vulnerability in Microsoft SharePoint Server stemming from improper input validation. Microsoft stated that successful exploitation could allow an unauthenticated attacker to view sensitive information or alter disclosed data over a network, though it poses low risk to system availability. Officials confirmed active exploitation in the wild, and the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply mitigations immediately. Patches are available for SharePoint Server 2016, 2019, and the Subscription Edition. Separately, CVE-2026-20945, another SharePoint spoofing issue with a lower severity score of 4.6, was also resolved.