Patch Tuesday, April 2026 Edition
Source Krebs on Security
Mentioned vulnerabilities
Rated Critical by Threat Radar from the Krebs on Security text
Data as of 26 May 2026, 19:42 UTC
What to do
AI-suggested
Microsoft has released official patches addressing all reported vulnerabilities, including the SharePoint zero-day and BlueHammer flaws. Applying these updates promptly is the primary mitigation. The BlueHammer exploit code is ineffective after patching. Adobe Reader and Google Chrome have also issued updates to fix actively exploited zero-days; users should apply these emergency updates immediately. Users must fully restart browsers and affected applications after updating to ensure patches are applied. There is no indication from the vendor that additional mitigation steps beyond patching are required.
Description
Microsoft released security updates addressing 167 vulnerabilities in Windows and related software, including a SharePoint Server zero-day (CVE-2026-32201) actively exploited in the wild and a Windows Defender privilege escalation flaw known as BlueHammer (CVE-2026-33825). Google Chrome and Adobe Reader also patched critical zero-day vulnerabilities with evidence of active exploitation. The SharePoint vulnerability allows attackers to spoof trusted content, increasing risks of phishing and social engineering. The BlueHammer exploit code was publicly released but is mitigated by the latest patches. This Patch Tuesday represents one of the largest update cycles for Microsoft, driven in part by AI-assisted vulnerability discovery. Users are advised to apply updates promptly and restart affected software to ensure protection.