Patch Tuesday April 2026: Microsoft’s Record 167 Fixes & New Zero‑Day Threats

Patch Tuesday delivers record ↑ 167 fixes

Microsoft rolled out an unprecedented batch of updates on Patch Tuesday, addressing a staggering ↑ 167 security flaws across Windows, SharePoint Server and ancillary tools. Among the most alarming is CVE-2026-32201, a SharePoint Server zero‑day that lets threat actors spoof trusted interfaces. Redmond warned that exploitation is already underway.

“This CVE can enable phishing attacks, unauthorized data manipulation, or social engineering campaigns that lead to further compromise,” said Mike Walters, Action1 co‑founder.

Google Chrome patched its fourth zero‑day of 2026, and Adobe issued an emergency update for CVE-2026-34621, a remote‑code‑execution bug active since November 2025, according to Reuters. Analysts note that even sectors as disparate as nuclear security are watching these developments.

BlueHammer and the race to patch

The Windows Defender privilege‑escalation flaw, dubbed “BlueHammer” (CVE-2026-33825), saw public exploit code released after the researcher grew impatient with Microsoft’s response. Tharros analyst Will Dormann confirmed the code now fails on systems updated today.

Security firms note the sheer volume – nearly ↑ 60 browser‑related bugs – marks the second‑largest Microsoft Patch Tuesday on record, says Tenable’s Satnam Narang.

Rapid7’s Adam Barnett linked the surge to expanding AI‑driven vulnerability discovery, citing the buzz around Anthropic’s upcoming Project Glasswing. “AI models are amplifying the speed and depth of research,” he observed.

Regardless of browser choice, users should fully close and restart to guarantee installation, a reminder echoed by Bloomberg. The same principle applies to the recent Chrome update fixing 21 issues, including high‑severity CVE-2026-5281.

For a detailed, per‑patch view, see the SANS Internet Storm Center roundup. If you encounter issues, the comments section often yields swift community fixes.

Intel provided by Kaelen Frost (Lead Cybersecurity Analyst).