Microsoft's security release of 14 April 2026
Patch Tuesday, April 2026
As of , CISA lists four of the 163 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-33825, Microsoft Defender Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2026-33825Microsoft Defender Elevation of Privilege. Listed by CISA on 22 April 2026, 8 days after the release
- CVE-2026-32201Microsoft SharePoint Server Spoofing. Listed by CISA on 14 April 2026, release day
- CVE-2026-32202Windows Shell Spoofing. Listed by CISA on 28 April 2026, 14 days after the release
- CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution. Listed by CISA on 18 August 2026, 126 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 163 CVEs |
| On CISA's list of exploited vulnerabilities | 4 CVEs |
| CISA's SSVC exploitation: active | 4 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 158 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 2 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-33825Microsoft Defender Elevation of Privilege | Active | Patch nowListed | 7.8 High | 0.00 |
| 2 | CVE-2026-32201Microsoft SharePoint Server Spoofing | Active | Patch soonListed | 6.5 Medium | 0.43 |
| 3 | CVE-2026-32202Windows Shell Spoofing | Active | Patch soonListed | 4.3 Medium | 0.05 |
| 4 | CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution | Active | Patch soonListed | 9.8 Critical | 0.02 |
| 5 | CVE-2026-33829Windows Snipping Tool Spoofing | Proof of concept | Not on CISA's list | 4.3 Medium | 0.02 |
| 6 | CVE-2026-20945Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.19 |
| 7 | CVE-2026-32184Microsoft High Performance Compute (HPC) Pack Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 8 | CVE-2026-32192Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 9 | CVE-2026-26171.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 10 | CVE-2026-32178.NET Spoofing | None | Not on CISA's list | 7.5 High | 0.02 |
| 11 | CVE-2026-32203.NET and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 12 | CVE-2026-33116.NET, .NET Framework, and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 13 | CVE-2026-26149Microsoft Power Apps Desktop Client Spoofing | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 14 | CVE-2026-26178Windows Advanced Rasterization Platform Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 15 | CVE-2026-32157Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 16 | CVE-2026-32171Azure Logic Apps Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2026-32225Windows Shell Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2026-33120Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2026-27928Windows Hello Security Feature Bypass | None | Not on CISA's list | 8.7 High | 0.01 |
| 20 | CVE-2026-33827Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 21 | CVE-2026-33826Windows Active Directory Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 22 | CVE-2026-23666.NET Framework Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 23 | CVE-2026-26154Windows Server Update Service (WSUS) Tampering | None | Not on CISA's list | 7.5 High | 0.01 |
| 24 | CVE-2026-32071Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 25 | CVE-2026-33096HTTP.sys Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 26 | CVE-2026-26151Remote Desktop Spoofing | None | Not on CISA's list | 7.1 High | 0.01 |
| 27 | CVE-2026-32188Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 28 | CVE-2026-32223Windows USB Printing Stack (usbprint.sys) Elevation of Privilege | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 29 | CVE-2026-26155Microsoft Local Security Authority Subsystem Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 30 | CVE-2026-27925Windows UPnP Device Host Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 31 | CVE-2026-32151Windows Shell Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 32 | CVE-2026-32226.NET Framework Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 33 | CVE-2026-23653GitHub Copilot and Visual Studio Code Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 34 | CVE-2026-27930Windows GDI Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 35 | CVE-2026-27931Windows GDI Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 36 | CVE-2026-26167Windows Push Notifications Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 37 | CVE-2026-32091Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 38 | CVE-2026-32162Windows COM Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 39 | CVE-2026-32190Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 40 | CVE-2026-32221Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 41 | CVE-2026-33114Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 42 | CVE-2026-33115Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 43 | CVE-2026-27912Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.00 |
| 44 | CVE-2026-20930Windows Management Services Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 45 | CVE-2026-23657Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 46 | CVE-2026-26143Microsoft PowerShell Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2026-26153Windows Encrypted File System (EFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2026-26156Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 49 | CVE-2026-26159Remote Desktop Licensing Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 50 | CVE-2026-26160Remote Desktop Licensing Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 51 | CVE-2026-26161Windows Sensor Data Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 52 | CVE-2026-26162Windows OLE Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 53 | CVE-2026-26163Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 54 | CVE-2026-26168Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 55 | CVE-2026-26170PowerShell Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 56 | CVE-2026-26172Windows Push Notifications Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 57 | CVE-2026-26176Windows Client Side Caching driver (csc.sys) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 58 | CVE-2026-26179Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 59 | CVE-2026-26180Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 60 | CVE-2026-26181Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 61 | CVE-2026-26183Remote Access Management service/API (RPC server) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 62 | CVE-2026-26184Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 63 | CVE-2026-27907Windows Storage Spaces Controller Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 64 | CVE-2026-27909Windows Search Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 65 | CVE-2026-27910Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 66 | CVE-2026-27911Windows User Interface Core Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 67 | CVE-2026-27914Microsoft Management Console Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 68 | CVE-2026-27915Windows UPnP Device Host Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 69 | CVE-2026-27916Windows UPnP Device Host Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 70 | CVE-2026-27918Windows Shell Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 71 | CVE-2026-27919Windows UPnP Device Host Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 72 | CVE-2026-27920Windows UPnP Device Host Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 73 | CVE-2026-27923Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 74 | CVE-2026-27924Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 75 | CVE-2026-27927Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 76 | CVE-2026-32069Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 77 | CVE-2026-32074Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 78 | CVE-2026-32076Windows Storage Spaces Controller Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 79 | CVE-2026-32077Windows UPnP Device Host Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 80 | CVE-2026-32078Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 81 | CVE-2026-32089Windows Speech Brokered Api Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 82 | CVE-2026-32090Windows Speech Brokered Api Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 83 | CVE-2026-32152Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 84 | CVE-2026-32153Windows Speech Runtime Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 85 | CVE-2026-32154Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 86 | CVE-2026-32155Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2026-32158Windows Push Notifications Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2026-32159Windows Push Notifications Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2026-32160Windows Push Notifications Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2026-32163Windows User Interface Core Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2026-32164Windows User Interface Core Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 92 | CVE-2026-32165Windows User Interface Core Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 93 | CVE-2026-32168Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 94 | CVE-2026-32183Windows Snipping Tool Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 95 | CVE-2026-32189Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 96 | CVE-2026-32197Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 97 | CVE-2026-32198Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 98 | CVE-2026-32199Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 99 | CVE-2026-32200Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 100 | CVE-2026-32222Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 14 April 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.