April 2026 Patch Tuesday — 168 CVEs Including 2 Active Zero-Days (SharePoint & Adobe Acrobat)

The 168-CVE Breakdown

The 168 CVE figure is 20-30% larger than a typical month. Some trackers report 163 (excluding Edge/Chromium-based patches), but the 168 number reflects the full bundle Microsoft shipped in the April security release. Broken down by severity (based on the 163 subset):

The affected products span Windows, Microsoft Office, SharePoint, Azure, .NET, Visual Studio, Edge, and several kernel-mode drivers. Two CVEs are classified as zero-days — one actively exploited, the other publicly disclosed with details already in the open, even if large-scale exploitation has not yet been observed.

The 2 Actively Exploited Zero-Days — SharePoint + Adobe Acrobat

Of the entire bundle, these two CVEs are the top priority — because there is real-world evidence of exploitation. That means these flaws are no longer theoretical; attackers are already using them today.

CVE-2026-32201 (SharePoint Spoofing) — organizations using SharePoint as their intranet, collaboration platform, or document-management system are exposed. An attacker can impersonate a user with legitimate privileges to upload documents, approve records, or trigger workflows that would normally require authorization — and pivot into lateral movement inside the network.

CVE-2026-34621 (Adobe Acrobat) — security researcher Haifei Li disclosed the exploitation details, describing crafted JavaScript embedded in malicious PDFs. Adobe publicly acknowledged being "aware of CVE-2026-34621 being exploited in the wild." If a user opens an attacker-supplied PDF (via phishing email or a spoofed download site), the endpoint can be compromised instantly — impacting not just servers but every user workstation (see context in Chrome Zero-day 2026).

CVE-2026-33824 — Windows IKE Extension RCE at CVSS 9.8

It is not yet known to be exploited in the wild, but CVE-2026-33824 is the highest-scored CVE in this release (CVSS 9.8), classified as "Critical" by Microsoft. The flaw sits in the Windows IKE Extension — the component responsible for key exchange in IPsec / VPN protocols.

The flaw is a double-free memory corruption, allowing an unauthenticated remote attacker to send a specially crafted packet to the IKE daemon, triggering memory reuse and arbitrary code execution on the server — with no credentials required. The pattern is similar to other enterprise-server flaws like the SharePoint CVE discovered earlier in 2026.

Why this matters for ERP: many Thai ERP deployments sit behind VPN gateways using IPsec — both to give remote staff access and to link branch offices to HQ. If the VPN gateway is not patched, attackers can bypass firewall boundaries and reach the ERP server directly, or use the IKE server as a pivot to attack the internal database (see more in ERP Security vs Emerging Threats).

Top 5 Patch Priorities for Thai Enterprises

Not every CVE must be patched in 24 hours — but these 5 groups should be at the top of your queue, because either in-the-wild exploits already exist or they are likely to appear within days:

1. SharePoint servers (if you have any) — patch CVE-2026-32201 immediately, since it is already being exploited. Thai organizations running SharePoint on-premise as an intranet or DMS should treat this as the highest priority.
2. VPN gateways running IKE/IPsec — patch CVE-2026-33824 (CVSS 9.8), particularly any gateway exposing IKE (ports 500/4500) to the internet. If you cannot patch quickly, temporarily block IKE from external networks.
3. Adobe Acrobat Reader on every endpoint — CVE-2026-34621 hits every workstation that opens PDFs. Push the update via Adobe Update or enterprise deployment tooling (SCCM/Intune). Treat this as equal priority to SharePoint.
4. General Windows Server systems (the 154 Important CVEs) — schedule a patch window within 7-14 days per the Thai government security standard.
5. ERP systems running on Windows Server — verify the patch cycle for any OS hosting ERP (accounting, HR, inventory). Even if the ERP itself has no CVE, a compromised host OS leaks ERP data all the same.

For more context on systematic patch management, see Information Security Fundamentals and Using 2FA to Block Credential Bypass. The broader Thai threat landscape is covered in Cybersecurity in Thailand.

Legacy ERP = Permanent CVE Exposure

A point that deserves more airtime: legacy ERP systems on end-of-support stacks will not receive these patches. The CVEs Microsoft ships each month apply only to Windows/Office versions still in mainstream support.

For example, Windows Server 2012 left Extended Support in 2023. That means organizations still hosting ERP on Windows Server 2012 will not receive the CVE-2026-33824 patch at all — the IKE Extension on Windows Server 2012 will remain CVSS-9.8 vulnerable indefinitely, surviving only on compensating controls (firewall rules, network segmentation).

On the ERP side itself, SAP Business Suite 7 ends mainstream support on December 31, 2027 and Microsoft Dynamics GP ends on September 30, 2029. After those dates, any new CVE becomes a permanent exposure. For a deeper look, see The Legacy ERP Sunset Countdown 2027-2035. The lesson every organization should absorb: budget for migration, not for emergency patching.

The Role of Thai ERP + Saeree in the Patch Race

Saeree ERP is not an "escape hatch" from Patch Tuesday — every modern application lives inside the OS + database + runtime patch cycle — but Saeree's architecture reduces attack surface compared to legacy ERP:

• Modern stack — Saeree deploys on PostgreSQL (a currently supported major version) plus current Linux kernels, both of which receive patches every 1-3 months, not "left behind" the way proprietary legacy databases often are.
• On-premise = customer controls the patch cycle — organizations can choose patch windows that do not collide with month-end closing.
• Cloud (GDCC) deployment — benefits from centralized patching by the cloud operator (GDCC), reducing in-house IT overhead.
• No dependence on SharePoint/Acrobat as core components — Saeree's document workflow uses internal PDF rendering, avoiding Adobe Acrobat's frequent CVE cycle.

To be clear: Saeree is not an "antidote" to every CVE — Windows endpoints still need their Adobe Reader patched; VPN gateways still need their IKE patched. But the ERP core (accounting, HR, inventory) does not sit directly on the Microsoft ecosystem, so the ERP-specific attack surface is much smaller than a legacy stack. See Thailand's Cybersecurity Landscape and Cybersecurity Trends 2026 for broader context.

Suitable / Not Suitable — Living With a Legacy Security Posture

An organization stuck with legacy ERP + legacy OS + manual patching can "get by" under certain conditions — but not all. Here is a quick fit/no-fit table:

If several rows on the red side feel uncomfortably familiar, it is time to reassess security posture. Start with SSL & security header checks as a baseline, and use lessons from other 2026 CVEs as reference material.