A critical hole in Windows Internet Key Exchange for secure communications, an actively exploited zero day in Microsoft SharePoint and a critical SQL injection vulnerability in a SAP product are the focus of the April Patch Tuesday releases requiring immediate attention from IT security teams.

“April’s threat landscape is defined by immediate, real-world exploitation rather than just theoretical vulnerabilities,” said Nick Carroll, ShadowScout team lead at Nightwing. “Security teams must prioritize active zero days in daily use applications like Chrome, Acrobat, and SharePoint, using behavioral threat intelligence over basic CVSS scores to stay ahead of adversaries.”

Carroll believes the most critical of the 167 issues Microsoft identifies this month is CVE-2026-32201 in SharePoint Server, which can allow an attacker to spoof SharePoint due to improper input validation. As a result, the attacker could view sensitive organization information and make changes to disclosed information. It’s being actively exploited.

Satnam Narang, senior staff research engineer at Tenable, said this hole “might sound like déjà vu, and that’s because the last SharePoint Server spoofing vulnerability exploited as a zero day was CVE-2025-49706 from July 2025, part of the ToolShell exploit chain used by ransomware and cyberespionage groups. While we lack insight into the in the wild exploitation associated with this latest flaw, and whether it is related to the ToolShell exploit chain, it underscores how valuable SharePoint Server is as a target for attackers.”

Kevin Breen, senior director of threat research at Immersive, noted that SharePoint services, especially those used as internal document stores, can be “a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments, [then] using double extortion techniques by threatening to release the stolen data if payment is not made.” 

A secondary concern, he added, is that threat actors with access to SharePoint services could deploy weaponized documents or replace legitimate documents with infected versions that would allow them to extend their reach to other hosts or victims, moving laterally across the organization.

Priority vulnerabilities

The highest rated vulnerability, at 9.8 on the CVSS scale, is in Windows Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824). It could allow a threat actor to run remote code on a system unless it is patched immediately. The attack complexity is low, and no user privileges are required. All an attacker has to do is send specially crafted packets to a Windows machine with IKE version 2 enabled.

Affected are Windows Server 2025; Windows Server 2022, 23H2 edition with the server core installation; Windows Server 2019 and 2016 with server core installation; and certain desktop versions of Windows 10 and 11 for x64, 32-bit and ARM systems.

Windows admins who can’t immediately install the security update can take one two actions, depending on their environment:

• block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;
• for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.

Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.

Breen said that while Microsoft has marked this flaw as ‘exploitation less likely,’ that doesn’t mean that it may not be exploitable. There have been historic exploits and proofs of concept (PoCs) that have impacted IKE, he said, so motivated threat actors may be able to weaponize this one as well. 

Jack Bicer, director of vulnerability research at Action1, said that from a strategic perspective, IT leadership should prioritize remediation efforts around the IKE issue and CVE-2026-33826, an Active Directory Remote Code Execution Vulnerability, due to their combination of exploitability and enterprise wide impact.

He said the Active Directory hole “represents a direct threat to identity infrastructure. By exploiting improper input validation in RPC handling, an authenticated attacker can execute arbitrary code within the domain. The low complexity of exploitation combined with the central role of Active Directory significantly amplifies risk. Once leveraged, this vulnerability can accelerate privilege escalation and enable full domain takeover, undermining enterprise trust boundaries.”

Bicer also said immediate attention should also be given to the Windows TCP IP Remote Code Execution Vulnerability, CVE 2026 33827, because of its reach across core networking functions, even with higher exploitation complexity.

“It is rare that you see a truly remote TCP/IP vulnerability these days,” commented Tyler Reguly, associate director for security R&D at Fortra, “and that’s exactly what CVE-2026-33827 is: unauthorized, network-based code execution against IPv6. The attack complexity is listed as high because the vulnerability is based on a race condition as well as ‘additional actions’, as Microsoft calls it, but it is still impressive to see these vulnerabilities identified in 2026.”

Another hole high on Breen’s list to patch is CVE-2026-33825, a Microsoft Defender elevation of privilege vulnerability. This is listed by Microsoft as Publicly Disclosed with a Proof Of Concept. 

An elevation of privilege vulnerability is commonly seen after an attacker has already gained initial access to a host machine, he said, perhaps via social engineering attacks. Exploiting a privilege hole allows the attacker to gain SYSTEM level permissions, he said, which is enough to disable security tools and logging before deploying additional malware and moving laterally. 

Breen pointed out that while Microsoft does not link this vulnerability to the recently publicly disclosed unpatched zero-day BlueHammer exploit that also impacts Microsoft Defender, “either way, ensuring that Defender is properly configured to receive timely updates is important, and should be a priority check this cycle given the existence of at least one, and possibly two public proofs of concept.”

Teams must be adequately resourced to cope

Reguly said CISOs this month might be worried about the sheer number of items that admins have to review. “There are a lot of CVEs and a lot of one-offs that we don’t normally see,” he said. “While Windows update and automatic updates for some applications will take care of a lot of the heavy lifting here, there’s still testing that is required before deploying updates this large. Additionally, with the likes of .NET, SharePoint, and SQL Server, there’s always the potential for difficult patches and/or version incompatibility that may crop up during testing.

“Patience is going to be a keyword this month, followed very quickly by resourcing. Massive patch drops like this, and the conversation around next-gen LLMs, mean that we need to be aware of the pressure on our teams and the amount of work they are expected to complete. If you still see your security teams as a cost centre, it is time to start rethinking that and looking at the value they bring to protecting your data and your systems. Large patch drops mean that you really need to review your teams to ensure they are adequately resourced.”

Patch volume may be tied to Mythos

AJ Grotto, former senior White House Director for Cyber Policy and currently research scholar at the Center for International Security and Cooperation at Stanford University, noted that the 167 Microsoft vulnerabilities identified this month more than doubled the March total and nearly tripled the February total.

“These numbers fluctuate,” he admitted, “but the increase is notable, especially in light of news that Anthtropic’s Mythos LLM excels at finding vulnerabilities. Microsoft is among the companies invited by Anthropic to participate in its preview initiative aimed at giving companies like Microsoft a head start patching their systems before the LLM is unleashed for general use.”

He wondered, “how much of the increase is due to Mythos? And how concerned should we be that April’s uptick in vulnerabilities in Microsoft’s already vuln-riddled products is only the tip of iceberg?”

Further, Chris Goettl, VP of product management at Ivanti, suggested that there is a connection between the just-patched Acrobat Reader zero day, other newly-found vulnerabilities, and Mythos.

“Most of the discussions around Mythos have focused on where it will be used and the ramifications,” he told CSO. “Finding exploitable flaws in code can be a powerful tool for good when used by the vendor writing the code before it is released. However, it will also be used by researchers and threat actors to find flaws in code that is already released, and that is where my speculation is directed.

“Consider the knock-on effects of a massive model like Mythos and what it will mean in the near term and longer term for the software that companies consume. In the near term, you will have the big players using a solution like this to release more secure code. As researchers and threat actors adopt more robust AI models to identify exploitable flaws, this will result in more coordinated disclosures (good), zero-day exploits (bad) and n-day exploits (bad). All of this will result in more frequent, and more importantly, urgent software updates.”   

Critical SAP vulnerability

Separately, SAP issued a patch for a critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. The vulnerable ABAP program allows a low privileged user to upload a file with arbitrary SQL statements that will then be executed. SAP Security Note #3719353, tagged with a CVSS score of 9.9, patches the vulnerability by deactivating all executable code within the affected program.

According to Onapsis, as a temporary workaround, SAP recommends revoking the S_GUI authorization object with Activity 60 (Upload) from user accounts. Since this workaround can lead to side effects in other applications for the affected users, and because of the criticality of the vulnerability, Onapsis strongly recommended applying the patch immediately. 

SAP Security Note #3731908, with a CVSS score of 7.1, patches a missing authorization check vulnerability in SAP ERP and SAP S/4 HANA (Private Cloud and on premises). According to Onapsis, the vulnerability allows an authenticated attacker to execute a particular ABAP program to overwrite any existing eight‑character executable program without authorization. SAP says a successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.