April Patch Tuesday: 163 Vulnerabilities, a Wormable TCP/IP RCE, and Two Already-Exploited Flaws

Microsoft's April 2026 Patch Tuesday is the second-largest single-month release on record, addressing 163 vulnerabilities across Windows, Office, Azure, and associated components. The headliner is CVE-2026-33827, a wormable remote code execution flaw in the Windows TCP/IP stack that can self-propagate across networks with no user interaction required. Two additional CVEs were already under active exploitation when the patches shipped. This is not a normal monthly patching cycle.

The Wormable Vulnerability: CVE-2026-33827

CVE-2026-33827 is a remote code execution vulnerability in the Windows TCP/IP stack, specifically in the handling of IPv6 packets during IKE/IPSec negotiation. An attacker on the same network segment, or reachable over any network path, can send a specially crafted packet sequence to a vulnerable Windows host and achieve code execution at the SYSTEM level with no authentication and no user interaction required.

The "wormable" designation means the vulnerability can be exploited to compromise a machine, then used from that machine to automatically exploit adjacent systems using the same technique. This is the same propagation model that made WannaCry and NotPetya so destructive. Network topology alone does not contain a wormable vulnerability once a single host is compromised inside the perimeter.

IPv6 is enabled by default on all modern Windows versions and cannot be disabled through the standard GUI. IPSec policy enforcement and IKE negotiation run in the kernel. The attack requires no existing foothold: a single packet exchange from any reachable source is sufficient. Microsoft rates this 9.8 CVSS, one of the highest scores in this release.

The Two Exploited Zero-Days

Two additional CVEs were being exploited in active campaigns before Microsoft released patches:

CVE-2026-32202 is a Windows authentication coercion vulnerability. It allows an attacker with network access to force a Windows host to authenticate to an attacker-controlled server, capturing NTLM credentials that can be relayed or cracked. This technique has been a persistent favorite in Active Directory environments for years; this CVE represents a new code path that bypassed existing mitigations. Observed exploitation preceded the April patch cycle by at least two weeks.

CVE-2026-33824 is a remote code execution flaw in the Windows IKE Protocol Extensions service. Unlike CVE-2026-33827, this vulnerability is not self-propagating, but it was under active exploitation by multiple threat groups at the time of patch release. Rapid7 and Tenable both confirmed in-the-wild exploitation targeting VPN gateway infrastructure.

Scale, Trend, and the AI Factor

163 CVEs in a single month is historically significant. The previous record was 157 in March 2024. The growth in monthly vulnerability count is not random: it reflects an acceleration in automated vulnerability research tooling, including AI-assisted code analysis that can identify classes of bugs faster than traditional manual review.

Security teams are now operating in an environment where the pace of disclosed vulnerabilities is outstripping patch capacity. The average enterprise takes 21 days to patch critical Windows vulnerabilities after release. For a wormable bug in the kernel networking stack, 21 days is an eternity. Prioritization frameworks are not optional anymore; they are a prerequisite for staying above water.

The concentration of IKE/IPSec vulnerabilities in this release, including both CVE-2026-33827 and CVE-2026-33824, suggests that component received particular scrutiny in the research community recently. Expect follow-on findings in the same subsystem. Organizations relying on Windows-native VPN and IPSec for internal network segmentation should assess whether the attack surface justifies the architecture.

Prioritization Framework for This Release

Not all 163 CVEs require the same response cadence. Here is a practical framework for this specific release:

Patch immediately (same day or next business day):

• CVE-2026-33827: wormable TCP/IP RCE. No user interaction required. Patch or mitigate before any other work.
• CVE-2026-32202: authentication coercion. Actively exploited. Any AD environment is at risk.
• CVE-2026-33824: IKE RCE. Actively exploited by multiple groups targeting VPN infrastructure.

Patch within 72 hours:

• Remaining 5 Critical-rated CVEs, particularly those affecting Hyper-V, Remote Desktop Services, and Exchange
• Any CVE affecting a component you have internet-exposed

Patch within standard monthly cycle:

• Important-rated CVEs with no exploitation reported, affecting components not directly accessible from outside the perimeter