Microsoft April 2026 Patches Address Multiple Vulnerabilities
Summary
CSA Singapore issued an alert on 15 April 2026 notifying that Microsoft released security patches addressing multiple vulnerabilities across its software products. The alert lists 11 vulnerabilities with CVSS base scores ranging from 7.5 to 9.8, including critical remote code execution vulnerabilities affecting Windows IKE extensions, Go compiler, SWIG, Remote Desktop Client, Microsoft Office, TCP/IP, and Active Directory. CSA recommends organizations apply the patches immediately.
What changed
CSA Singapore published an alert on 15 April 2026 notifying of Microsoft security patches for 11 vulnerabilities. The most severe are CVE-2026-33824 (Windows IKE extensions, CVSS 9.8), CVE-2026-27143 (Go compiler memory corruption, CVSS 9.8), and CVE-2026-27140 (SWIG code generation, CVSS 9.8), along with multiple Microsoft Office and Windows RCE vulnerabilities with scores between 7.5 and 8.8.\n\nOrganizations using Microsoft software products should prioritize immediate patching of these vulnerabilities, particularly the three critical RCE flaws rated at 9.8. IT security teams should review the full patch list from Microsoft's Security Response Center and establish patching schedules to address all affected systems before potential exploitation.
What to do next
- Apply Microsoft security patches immediately
- Refer to Microsoft Security Response Center for full patch details
Archived snapshot
Apr 15, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Monthly Patch
April 2026 Monthly Patch
15 April 2026
Microsoft has released security patches to address multiple vulnerabilities in their software and products.
Microsoft has released security patches to address multiple vulnerabilities in their software and products.
The vulnerabilities that have been classified as Critical in severity are listed in the table below.
For the full list of security patches released by Microsoft, please refer to https://msrc.microsoft.com/update-guide/en-us/releaseNote/2026-Apr
CRITICAL VULNERABILITIES
Table caption
| CVE Number | CVE Name | Base Score | Reference |
|---|---|---|---|
| CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824 |
| CVE-2026-27143 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-27143 |
| CVE-2026-27140 | Code execution vulnerability in SWIG code generation in cmd/go | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-27140 |
| CVE-2026-32157 | Remote Desktop Client Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32157 |
| CVE-2026-33115 | Microsoft Word Remote Code Execution Vulnerability | 8.4 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33115 |
| CVE-2026-33114 | Microsoft Word Remote Code Execution Vulnerability | 8.4 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33114 |
| CVE-2026-32190 | Microsoft Office Remote Code Execution Vulnerability | 8.4 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32190 |
| CVE-2026-33827 | Windows TCP/IP Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33827 |
| CVE-2026-33826 | Windows Active Directory Remote Code Execution Vulnerability | 8.0 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33826 |
| CVE-2026-23666 | .NET Framework Denial of Service Vulnerability | 7.5 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-23666 |
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.