Microsoft April Patch Tuesday Breaks Records with 167 Flaws, Including Actively Exploited Zero-Days
Microsoft Releases Urgent Patches for 167 Security Vulnerabilities
Microsoft has issued software updates addressing a staggering 167 security flaws in Windows and related products, the second-largest Patch Tuesday in history. The bulk includes a zero-day vulnerability in SharePoint Server (CVE-2026-32201) that attackers are already actively exploiting. Additionally, Google Chrome has fixed its fourth zero-day of 2026, and Adobe released an emergency patch for Reader to fix an actively exploited remote code execution flaw.
Active Exploitation of SharePoint Zero-Day
Microsoft warned that CVE-2026-32201 allows attackers to spoof trusted content or interfaces over a network, putting organizations at immediate risk. Mike Walters, president and co-founder of Action1, said the flaw can be used to deceive employees, partners, or customers by presenting falsified information within trusted SharePoint environments.
“This CVE can enable phishing attacks, unauthorized data manipulation, or social engineering campaigns that lead to further compromise. The presence of active exploitation significantly increases organizational risk.” — Mike Walters, Action1
Windows Defender ‘BlueHammer’ Flaw Publicly Disclosed
Microsoft also fixed CVE-2026-33825, a privilege escalation bug in Windows Defender known as “BlueHammer.” The vulnerability gained notoriety after the researcher who reported it published exploit code, frustrated with Microsoft’s response. Will Dormann, senior principal vulnerability analyst at Tharros, confirmed that installing today’s patches neutralizes the public exploit code.
Record Number of Browser-Related Patches
April’s Patch Tuesday includes nearly 60 browser vulnerabilities, a new record. Adam Barnett, lead software engineer at Rapid7, said it might be tempting to tie the spike to the recent announcement of Project Glasswing, a hyped AI capability from Anthropic designed to find bugs. However, he noted that Microsoft Edge is based on Chromium, and Chromium maintainers credit a wide range of researchers for the republished vulnerabilities.
“A safe conclusion is that this increase in volume is driven by ever-expanding AI capabilities. We should expect to see further increases in vulnerability reporting volume as the impact of AI models extend further.” — Adam Barnett, Rapid7
Background
Microsoft’s Patch Tuesday is a monthly cycle of security updates. April 2026 marks the second-largest set of fixes ever, trailing only a previous record. The sheer number—167 vulnerabilities—reflects a growing trend in vulnerability disclosure, partly attributed to AI-powered detection tools.
Separately, Adobe issued an emergency update on April 11 for CVE-2026-34621, a Reader vulnerability actively exploited since at least November 2025. Satnam Narang, senior staff research engineer at Tenable, confirmed the extended exploitation window.
What This Means
Organizations must prioritize patching the SharePoint zero-day and the BlueHammer flaw immediately, given active exploitation. The large volume of browser patches underscores the need to restart browsers after updates. AI-driven vulnerability discovery will likely continue to increase the number of patches, requiring faster response cycles.
For users, this means keeping all software—including browsers and Adobe Reader—up to date. Restarting browsers completely after updates is critical to ensure protections take effect. The cybersecurity community expects future Patch Tuesdays to remain heavy as AI tools improve.