One CVE under attack, one already disclosed by angry bug hunter, and 163 more
Attackers exploited a spoofing vulnerability in Microsoft SharePoint Server before Redmond issued a fix as part of April's mega Patch Tuesday.
The monthly patch party included a whopping 165 new Microsoft CVEs.
And the bug under active exploitation, CVE-2026-32201, is due to improper input validation in SharePoint that allows an unauthorized attacker to perform spoofing over a network. This could allow someone to view sensitive information and make changes to disclosed information.
"By exploiting this flaw, an attacker can manipulate how information is presented to users, potentially tricking them into trusting malicious content," Mike Walters, president and cofounder of patch management provider Action1, told us, adding that this bug can be abused in phishing attacks, unauthorized data manipulation, or social engineering campaigns that lead to further compromise.
"The flaw lets attackers fake trust at scale: what looks legitimate may actually be a carefully crafted deception," Walters said. "It can be used to deceive employees, partners, or customers by presenting falsified information within trusted SharePoint environments."
Redmond did not provide any details about how this security hole is being abused in the wild - nor who disclosed it.
Maybe Mythos, or another bug-hunting AI? The Register asked Microsoft to provide additional information, and here's what we received: "Each year, MSRC processes thousands of vulnerability reports from Microsoft and external researchers, so the number addressed in any given Update Tuesday can vary. Today’s release does not reflect a significant increase in AI‑driven discoveries, though we did credit one vulnerability to an Anthropic researcher using Claude."
As Zero Day Initiative chief vuln finder Dustin Childs noted in his monthly PT writeup, this is - by his count - Microsoft's second-largest monthly CVE release ever.
"There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools," Childs wrote.
While CVE-2026-32201 is the only bug out of the 165 new CVEs listed as under active exploitation - at the time of release, anyway - another bug is publicly known.
This one, tracked as CVE-2026-33825, is an elevation of privilege flaw in Microsoft Defender. While Microsoft doesn't mention this in its advisory, other security shops pointed out that the Defender bug matches exploit code called BlueHammer, published on GitHub earlier this month by a disgruntled researcher calling themselves "Chaotic Eclipse."
It seems they were none too happy with Microsoft's disclosure process. "I never wanted to reopen a blog and a new github account to drop code... But someone violated our agreement and left me homeless with nothin…," Chaotic Eclipse wrote on April 2.
They aren't the first to criticize Redmond's bug reporting process and response to researchers.
"I won't add on to the commentary from the researcher about working with Microsoft," Childs wrote. "I'm just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly." ®