Microsoft’s April 2026 Patch Tuesday: 167 Flaws Fixed and Urgent Secure Boot Warnings
Microsoft’s April 2026 Patch Tuesday has arrived with a massive security rollout, addressing 167 vulnerabilities across its ecosystem. This month’s updates are particularly critical, as they resolve two zero-day flaws and provide a necessary baseline for Windows 11 hotpatching, all while the clock ticks down toward a significant Secure Boot certificate expiration.
The Breakdown: 167 Vulnerabilities Addressed
The scale of this month’s update is substantial. Microsoft has patched a wide array of flaws, including eight “Critical” vulnerabilities. Of those critical issues, seven are remote code execution (RCE) flaws, and one is a denial of service flaw. According to BleepingComputer, the vulnerability categories break down as follows:
- Elevation of Privilege: 93 vulnerabilities
- Remote Code Execution: 20 vulnerabilities
- Information Disclosure: 21 vulnerabilities
- Security Feature Bypass: 13 vulnerabilities
- Denial of Service: 10 vulnerabilities
- Spoofing: 9 vulnerabilities
Zero-Day Threats and SharePoint Exploits
Two zero-day vulnerabilities were a primary focus of this release. While one was publicly disclosed, the other was actively exploited in the wild. The most pressing of these is CVE-2026-32201, a Microsoft SharePoint Server Spoofing Vulnerability. This flaw allowed unauthorized attackers to perform spoofing over a network due to improper input validation in Microsoft Office SharePoint.
Windows 11 Updates: KB5083769 and Build Changes
For users on Windows 11, the headline update is KB5083769. This cumulative update targets versions 25H2 and 24H2, advancing them to OS builds 26200.8246 and 26100.8246, respectively.
This release is more than just a security rollup; it serves as the Q2 2026 hotpatch baseline. Because of this, a system restart is required this month, even for devices that are typically hotpatch-eligible. The update also consolidates several March fixes, including those from the March 31 out-of-band build (KB5086672) and the March 21 release (KB5085516). It notably replaces the March 26 preview (KB5079391), which was previously pulled due to installation errors.
Users on older supported builds are not left behind. Windows 11 23H2 received KB5082052, moving that branch to OS Build 22631.6936.
Urgent: Secure Boot Certificate Expiration
Beyond the immediate patches, Microsoft has issued a critical warning regarding Windows Secure Boot certificate expiration. Certificates used by the majority of Windows devices are set to expire starting in June 2026. If these certificates aren’t updated in time, certain personal and business devices may lose the ability to boot securely. Microsoft recommends reviewing guidance and updating certificates immediately to avoid disruption, as detailed in the official support documentation.
Key Takeaways for Administrators and Users
| Update/Issue | Impact/Action | Affected Version |
|---|---|---|
| KB5083769 | Mandatory security update; requires restart | Windows 11 25H2 / 24H2 |
| KB5082052 | April security release | Windows 11 23H2 |
| CVE-2026-32201 | Actively exploited spoofing flaw | Microsoft SharePoint Server |
| Secure Boot Certs | Expire starting June 2026; update now | Most Windows devices |
Frequently Asked Questions
Why do I need to restart my computer if I have a hotpatch-eligible device?
Because KB5083769 serves as the Q2 2026 hotpatch baseline, a restart is mandatory this month to establish the new baseline for future updates. What happens if I ignore the Secure Boot certificate update?
Devices that are not updated before the June 2026 expiration may be unable to boot securely, potentially leading to system instability or failure to start. Are there any known issues with the April update?
Yes, Microsoft has noted that devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key after the update.