Patch Tuesday April 2026: what's exploited and what to install first
Microsoft released fixes for 163 vulnerabilities on Apr 14, 2026. 2 are already being exploited by attackers, so install those fixes first. 1 was publicly disclosed before the fix came out. 8 are rated Critical.
Install these first: already exploited
- Microsoft Office SharePointExploitedImportantCVSS 6.5Microsoft SharePoint Server Spoofing Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Windows ShellExploitedImportantCVSS 4.3Windows Shell Spoofing Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
Publicly disclosed before the fix
Details were public before Microsoft's update, so attacks often follow quickly.
Critical fixes
- CVSS 9.8 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
- CVSS 8.8 Remote Desktop Client Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Office Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Word Remote Code Execution Vulnerability
- CVSS 8.4 Microsoft Word Remote Code Execution Vulnerability
- CVSS 8.1 Windows TCP/IP Remote Code Execution Vulnerability
- CVSS 8.0 Windows Active Directory Remote Code Execution Vulnerability
- CVSS 7.5 .NET Framework Denial of Service Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 93 |
| Information Disclosure | 20 |
| Remote Code Execution | 20 |
| Security Feature Bypass | 11 |
| Spoofing | 9 |
| Denial of Service | 9 |
| Tampering | 1 |
Most-patched products
| Product | Fixes |
|---|---|
| Windows Ancillary Function Driver for WinSock | 8 |
| Windows Universal Plug and Play (UPnP) Device Host | 8 |
| Windows Kernel | 7 |
| Windows Shell | 6 |
| Microsoft Office Word | 5 |
| Windows Push Notifications | 5 |
| Windows Projected File System | 5 |
| Desktop Window Manager | 5 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday April 2026?
The 2 exploited flaws: Microsoft SharePoint Server Spoofing Vulnerability; Windows Shell Spoofing Vulnerability. Attackers are already using them.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's April 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 1, 2026. General information only; confirm details with Microsoft.