Microsoft's massive Patch Tuesday: It's raining bugs

Overview

It has been reported that Microsoft shipped fixes for a whopping 165 new CVEs in April's Patch Tuesday — and one of them, CVE-2026-32201 in SharePoint Server, is already listed as under active exploitation. The flaw, an improper input‑validation issue that can be abused for spoofing over a network, can let an attacker manipulate how information is presented, potentially exposing sensitive data or changing displayed content. Mike Walters of patch management provider Action1 warned this sort of weakness "lets attackers fake trust at scale" — ideal fuel for phishing and social engineering. Ouch.

The public disclosures and a grumpy researcher

Another bug, CVE-2026-33825, affects Microsoft Defender and is a privilege‑elevation issue that security shops say matches exploit code called BlueHammer, allegedly published to GitHub by a disgruntled researcher who goes by "Chaotic Eclipse." The researcher complained about Microsoft's disclosure process in a public post, saying they did not want to release code but felt forced; it has been reported that the publish was born of frustration. Microsoft did not call out that Defender flaw in its advisory and has not provided further detail about the SharePoint exploit when asked.

Bigger picture: AI, volume, and frayed tempers

Dustin Childs of Zero Day Initiative noted this is, by his count, Microsoft’s second‑largest monthly CVE release ever — and he suspects a growing share of submissions are being found by AI tools. All your zero‑days are belong to Mythos? Maybe. The emotional core here is clear: researchers are finding more bugs, sometimes loudly and angrily, and vendors are scrambling to keep up. That friction matters; it affects disclosure timelines, exploit publication, and ultimately whether defenders have time to patch.

What to do now

For admins and security teams: patch quickly, test carefully, and prioritize the SharePoint and Defender updates — Childs and others urge rapid deployment for Defender in particular. One CVE listed as actively exploited today could become several tomorrow. Patch Tuesday has become a monsoon; don’t get caught in the flood.

Sources: The Register