April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs

block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that while Microsoft has marked this flaw as ‘exploitation less likely,’ that doesn’t mean that it may not be exploitable. There have been historic exploits and proofs of concept (PoCs) that have impacted IKE, he said, so motivated threat actors may be able to weaponize this one as well. Jack Bicer, director of vulnerability research at Action1, said that from a strategic perspective, IT leadership should prioritize remediation efforts around the IKE issue and CVE-2026-33826, an Active Directory Remote Code Execution Vulnerability, due to their combination of exploitability and enterprise wide impact.He said the Active Directory hole “represents a direct threat to identity infrastructure. By exploiting improper input validation in RPC handling, an authenticated attacker can execute arbitrary code within the domain. The low complexity of exploitation combined with the central role of Active Directory significantly amplifies risk. Once leveraged, this vulnerability can accelerate privilege escalation and enable full domain takeover, undermining enterprise trust boundaries.”Bicer also said immediate attention should also be given to the Windows TCP IP Remote Code Execution Vulnerability, CVE 2026 33827, because of its reach across core networking functions, even with higher exploitation complexity.”It is rare that you see a truly remote TCP/IP vulnerability these days,” commented Tyler Reguly, associate director for security R&D at Fortra, “and that’s exactly what CVE-2026-33827 is: unauthorized, network-based code execution against IPv6. The attack complexity is listed as high because the vulnerability is based on a race condition as well as ‘additional actions’, as Microsoft calls it, but it is still impressive to see these vulnerabilities identified in 2026.”Another hole high on Breen’s list to patch is CVE-2026-33825, a Microsoft Defender elevation of privilege vulnerability. This is listed by Microsoft as Publicly Disclosed with a Proof Of Concept. An elevation of privilege vulnerability is commonly seen after an attacker has already gained initial access to a host machine, he said, perhaps via social engineering attacks. Exploiting a privilege hole allows the attacker to gain SYSTEM level permissions, he said, which is enough to disable security tools and logging before deploying additional malware and moving laterally. Breen pointed out that while Microsoft does not link this vulnerability to the recently publicly disclosed unpatched zero-day BlueHammer exploit that also impacts Microsoft Defender, “either way, ensuring that Defender is properly configured to receive timely updates is important, and should be a priority check this cycle given the existence of at least one, and possibly two public proofs of concept.”

Teams must be adequately resourced to cope: Reguly said CISOs this month might be worried about the sheer number of items that admins have to review. “There are a lot of CVEs and a lot of one-offs that we don’t normally see,” he said. “While Windows update and automatic updates for some applications will take care of a lot of the heavy lifting here, there’s still testing that is required before deploying updates this large. Additionally, with the likes of .NET, SharePoint, and SQL Server, there’s always the potential for difficult patches and/or version incompatibility that may crop up during testing.”Patience is going to be a keyword this month, followed very quickly by resourcing. Massive patch drops like this, and the conversation around next-gen LLMs, mean that we need to be aware of the pressure on our teams and the amount of work they are expected to complete. If you still see your security teams as a cost centre, it is time to start rethinking that and looking at the value they bring to protecting your data and your systems. Large patch drops mean that you really need to review your teams to ensure they are adequately resourced.”

Patch volume may be tied to Mythos: AJ Grotto, former senior White House Director for Cyber Policy and currently research scholar at the Center for International Security and Cooperation at Stanford University, noted that the 167 Microsoft vulnerabilities identified this month more than doubled the March total and nearly tripled the February total. “These numbers fluctuate,” he admitted, “but the increase is notable, especially in light of news that Anthtropic’s Mythos LLM excels at finding vulnerabilities. Microsoft is among the companies invited by Anthropic to participate in its preview initiative aimed at giving companies like Microsoft a head start patching their systems before the LLM is unleashed for general use.”He wondered, “how much of the increase is due to Mythos? And how concerned should we be that April’s uptick in vulnerabilities in Microsoft’s already vuln-riddled products is only the tip of iceberg?”Further, Chris Goettl, VP of product management at Ivanti, suggested that there is a connection between the just-patched Acrobat Reader zero day, other newly-found vulnerabilities, and Mythos.”Most of the discussions around Mythos have focused on where it will be used and the ramifications,” he told CSO. “Finding exploitable flaws in code can be a powerful tool for good when used by the vendor writing the code before it is released. However, it will also be used by researchers and threat actors to find flaws in code that is already released, and that is where my speculation is directed.”Consider the knock-on effects of a massive model like Mythos and what it will mean in the near term and longer term for the software that companies consume. In the near term, you will have the big players using a solution like this to release more secure code. As researchers and threat actors adopt more robust AI models to identify exploitable flaws, this will result in more coordinated disclosures (good), zero-day exploits (bad) and n-day exploits (bad). All of this will result in more frequent, and more importantly, urgent software updates.”   

Critical SAP vulnerability: Separately, SAP issued a patch for a critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. The vulnerable ABAP program allows a low privileged user to upload a file with arbitrary SQL statements that will then be executed. SAP Security Note #3719353, tagged with a CVSS score of 9.9, patches the vulnerability by deactivating all executable code within the affected program. According to Onapsis, as a temporary workaround, SAP recommends revoking the S_GUI authorization object with Activity 60 (Upload) from user accounts. Since this workaround can lead to side effects in other applications for the affected users, and because of the criticality of the vulnerability, Onapsis strongly recommended applying the patch immediately. SAP Security Note #3731908, with a CVSS score of 7.1, patches a missing authorization check vulnerability in SAP ERP and SAP S/4 HANA (Private Cloud and on premises). According to Onapsis, the vulnerability allows an authenticated attacker to execute a particular ABAP program to overwrite any existing eight”‘character executable program without authorization. SAP says a successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

First seen on csoonline.com

Jump to article: www.csoonline.com/article/4158706/april-patch-tuesday-roundup-zero-day-vulnerabilities-and-critical-bugs.html