Patch Tuesday, April 2026
Microsoft's monthly security release, Tuesday, April 14, 2026. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
13 CVEs · 0 critical · 6 exploited · 0 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
13 CVEs · 0 critical · 6 exploited · 0 with public exploit code
- 8.8HighApr 14, 2026Microsoft Office Code / command injectionCVE-2009-0238Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.Exploited43% likely
- 8.8HighApr 13, 2026Microsoft Exchange Server DeserializationCVE-2023-21529Microsoft Exchange Server is affected. An attacker gains arbitrary code execution on the server. Update Microsoft Exchange Server to the latest version with security patches applied.Exploited59% likely
- 7.8HighApr 13, 2026Microsoft Visual Basic for Applications (VBA)CVE-2012-1854Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.Exploited21% likely
- 7.8HighApr 13, 2026Microsoft Windows Memory corruptionCVE-2023-36424Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalationExploited12% likely
- 7.8HighApr 13, 2026Microsoft Windows Path traversal / file handlingCVE-2025-60710Microsoft Windows contains a link following vulnerability that allows for privilege escalationExploited4.6% likely
- 6.5MediumApr 14, 2026Microsoft SharePoint ServerCVE-2026-32201Microsoft SharePoint Server An attacker gains unauthorized access to sensitive information Patch SharePoint Server with the latest security updates and restrict access to the vulnerable feature.Exploited43% likely
- 8.8HighApr 14, 2026Microsoft azure logic appsCVE-2026-32171Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
- 7.8HighApr 14, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-27916Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- 7.8HighApr 14, 2026Microsoft 365 apps Memory corruptionCVE-2026-32197Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.0HighApr 14, 2026Microsoft windows 10 1607CVE-2026-32068Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
- 6.7MediumApr 14, 2026Microsoft windows 10 1607CVE-2026-0390Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.
- 6.5MediumApr 14, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-26155Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
- 6.1MediumApr 14, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-26169Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.2.3% likely
Adobe
2 CVEs · 0 critical · 2 exploited · 0 with public exploit code
- 8.6HighApr 13, 2026Adobe Acrobat and ReaderCVE-2026-34621Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.Exploited2.2% likely
- 7.8HighApr 13, 2026Adobe Acrobat Memory corruptionCVE-2020-9715Adobe Acrobat contains a use-after-free vulnerability that allows for code executionExploited33% likely
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.