# Microsoft April 2026 security update CVE-2026-32201 exploited

Published: 2026-04-14 · Severity: elevated · Sectors: government-national, technology, financial-services, healthcare, education, manufacturing, telecommunications, transportation, retail, energy, defense, infrastructure
Canonical: https://vorant.io/reports/8ecf6554-757a-5ee1-9586-0872be45750c/microsoft-april-2026-security-update-cve-2026-32201-exploited

> Microsoft patches April 2026 vulnerabilities including CVE-2026-32201, which is actively exploited in the wild.

Microsoft has released its monthly security update for April 2026, addressing multiple vulnerabilities across its product portfolio. CVE-2026-32201 has been confirmed by Microsoft as actively exploited in the wild, making it a priority for immediate patching. The vulnerabilities addressed in this update could allow attackers to cause application crashes or achieve full system compromise depending on the specific flaw exploited. IPA (Information-technology Promotion Agency, Japan) is advising all organizations to apply security patches urgently, particularly for CVE-2026-32201. Organizations managing centralized update policies should prioritize deployment of these patches. Most users will receive updates automatically through Windows Update, though system restarts may be required to complete installation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-32201 (KEV)

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0415-ms.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8ecf6554-757a-5ee1-9586-0872be45750c/microsoft-april-2026-security-update-cve-2026-32201-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup