Three vulnerabilities demand immediate action from security teams in April's Patch Tuesday releases: a critical flaw in Windows Internet Key Exchange for secure communications, an actively exploited zero-day in Microsoft SharePoint, and a critical SQL injection vulnerability in SAP products.
"April's threat landscape is defined by immediate, real-world exploitation rather than just theoretical vulnerabilities," said Nick Carroll, ShadowScout team lead at Nightwing. "Security teams must prioritize active zero-days in daily-use applications like Chrome, Acrobat, and SharePoint, using behavioral threat intelligence over basic CVSS scores to stay ahead of adversaries."
Among the 167 issues Microsoft addressed this month, Carroll identified CVE-2026-32201 in SharePoint Server as the most critical. The vulnerability stems from improper input validation, enabling attackers to spoof SharePoint, view sensitive organizational data, and modify disclosed information. Microsoft confirmed active exploitation in the wild.
Satnam Narang, senior staff research engineer at Tenable, noted the pattern feels familiar. "The last SharePoint Server spoofing vulnerability exploited as a zero-day was CVE-2025-49706 from July 2025, part of the ToolShell exploit chain used by ransomware and cyberespionage groups. While we lack insight into the in-the-wild exploitation associated with this latest flaw, and whether it relates to the ToolShell exploit chain, it underscores how valuable SharePoint Server is as a target for attackers."
Kevin Breen, senior director of threat research at Immersive, emphasized that SharePoint services, particularly internal document stores, represent "a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments, using double-extortion techniques by threatening to release the stolen data if payment is not made."
Beyond data theft, Breen warned that attackers with SharePoint access could deploy weaponized documents or replace legitimate files with infected versions, enabling lateral movement across the organization.
Priority vulnerabilities
The highest-rated vulnerability this month, scoring 9.8 on the CVSS scale, affects Windows Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824). The flaw enables remote code execution with low attack complexity and no required user privileges. Attackers need only send specially crafted packets to Windows machines with IKE version 2 enabled.
Affected systems include Windows Server 2025; Windows Server 2022, 23H2 edition with server core installation; Windows Server 2019 and 2016 with server core installation; and certain desktop versions of Windows 10 and 11 for x64, 32-bit, and ARM systems.
Windows administrators unable to immediately deploy the security update can implement temporary mitigations:
- Block inbound traffic on UDP ports 500 and 4500 for systems not using IKE
- For systems requiring IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses
Microsoft cautioned that these measures reduce the attack surface but don't replace installing the security update.
Breen noted that while Microsoft marked this flaw as "exploitation less likely," that assessment doesn't guarantee safety. "There have been historic exploits and proofs of concept that have impacted IKE, so motivated threat actors may be able to weaponize this one as well."
Jack Bicer, director of vulnerability research at Action1, recommended IT leadership prioritize remediation for the IKE issue alongside CVE-2026-33826, an Active Directory Remote Code Execution vulnerability, due to their exploitability and enterprise-wide impact.
The Active Directory flaw "represents a direct threat to identity infrastructure," Bicer explained. "By exploiting improper input validation in RPC handling, an authenticated attacker can execute arbitrary code within the domain. The low complexity of exploitation combined with the central role of Active Directory significantly amplifies risk. Once leveraged, this vulnerability can accelerate privilege escalation and enable full domain takeover, undermining enterprise trust boundaries."
Bicer also flagged the Windows TCP/IP Remote Code Execution vulnerability, CVE-2026-33827, for immediate attention due to its reach across core networking functions, despite higher exploitation complexity.
"It is rare that you see a truly remote TCP/IP vulnerability these days," commented Tyler Reguly, associate director for security R&D at Fortra, "and that's exactly what CVE-2026-33827 is: unauthorized, network-based code execution against IPv6. The attack complexity is listed as high because the vulnerability is based on a race condition as well as 'additional actions,' as Microsoft calls it, but it is still impressive to see these vulnerabilities identified in 2026."
Breen highlighted CVE-2026-33825, a Microsoft Defender elevation of privilege vulnerability, as another high-priority patch. Microsoft listed it as publicly disclosed with a proof of concept available.
Elevation of privilege vulnerabilities typically come into play after attackers gain initial access, perhaps through social engineering. Exploiting such flaws grants SYSTEM-level permissions, enabling attackers to disable security tools and logging before deploying additional malware and moving laterally.
While Microsoft hasn't linked this vulnerability to the recently disclosed unpatched zero-day BlueHammer exploit that also impacts Microsoft Defender, Breen advised caution. "Either way, ensuring that Defender is properly configured to receive timely updates is important, and should be a priority check this cycle given the existence of at least one, and possibly two public proofs of concept."
Teams must be adequately resourced to cope
Reguly warned CISOs about the volume of items requiring review this month. "There are a lot of CVEs and a lot of one-offs that we don't normally see. While Windows update and automatic updates for some applications will take care of a lot of the heavy lifting here, there's still testing that is required before deploying updates this large. Additionally, with the likes of .NET, SharePoint, and SQL Server, there's always the potential for difficult patches and version incompatibility that may crop up during testing.
"Patience is going to be a keyword this month, followed very quickly by resourcing. Massive patch drops like this, and the conversation around next-gen LLMs, mean that we need to be aware of the pressure on our teams and the amount of work they are expected to complete. If you still see your security teams as a cost center, it is time to start rethinking that and looking at the value they bring to protecting your data and your systems. Large patch drops mean that you really need to review your teams to ensure they are adequately resourced."
Patch volume may be tied to Mythos
AJ Grotto, former senior White House Director for Cyber Policy and currently research scholar at the Center for International Security and Cooperation at Stanford University, observed that the 167 Microsoft vulnerabilities identified this month more than doubled the March total and nearly tripled the February total.
"These numbers fluctuate," he acknowledged, "but the increase is notable, especially in light of news that Anthropic's Mythos LLM excels at finding vulnerabilities. Microsoft is among the companies invited by Anthropic to participate in its preview initiative aimed at giving companies like Microsoft a head start patching their systems before the LLM is unleashed for general use."
Grotto questioned how much of the increase stems from Mythos, and whether April's uptick in vulnerabilities represents only the beginning of a larger trend.
Chris Goettl, VP of product management at Ivanti, suggested a connection between the recently patched Acrobat Reader zero-day, other newly discovered vulnerabilities, and Mythos.
"Most of the discussions around Mythos have focused on where it will be used and the ramifications," he told CSO. "Finding exploitable flaws in code can be a powerful tool for good when used by the vendor writing the code before it is released. However, it will also be used by researchers and threat actors to find flaws in code that is already released, and that is where my speculation is directed.
"Consider the knock-on effects of a massive model like Mythos and what it will mean in the near term and longer term for the software that companies consume. In the near term, you will have the big players using a solution like this to release more secure code. As researchers and threat actors adopt more robust AI models to identify exploitable flaws, this will result in more coordinated disclosures (good), zero-day exploits (bad), and n-day exploits (bad). All of this will result in more frequent, and more importantly, urgent software updates."
Critical SAP vulnerability
SAP issued a patch for a critical SQL injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. The vulnerable ABAP program allows a low-privileged user to upload a file containing arbitrary SQL statements that will then be executed. SAP Security Note #3719353, tagged with a CVSS score of 9.9, patches the vulnerability by deactivating all executable code within the affected program.
According to Onapsis, SAP recommends revoking the S_GUI authorization object with Activity 60 (Upload) from user accounts as a temporary workaround. However, because this workaround can cause side effects in other applications for affected users, and given the vulnerability's criticality, Onapsis strongly recommended applying the patch immediately.
SAP Security Note #3731908, with a CVSS score of 7.1, patches a missing authorization check vulnerability in SAP ERP and SAP S/4 HANA (Private Cloud and on-premises). The vulnerability allows an authenticated attacker to execute a particular ABAP program to overwrite any existing eight-character executable program without authorization. SAP stated that successful exploitation impacts availability, with limited impact on integrity confined to the affected report, while confidentiality remains unaffected.
