Microsoft Patch Tuesday, April 2026: the CVEs

Microsoft Patch Tuesday April 2026: the CVEs Microsoft published on 14 April 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 7.8CVE-2026-33825KEVEPSS 6.9%2026-04-14

   Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

2. 9.8CVE-2026-33824KEVEPSS 77%2026-04-14

   Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

3. 4.3CVE-2026-32202KEVExploitEPSS 71%2026-04-14

   Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

4. 6.5CVE-2026-32201KEVEPSS 44%2026-04-14

   Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.