Microsoft Patches 163 Flaws Including Exploited SharePoint Bug

Microsoft released fixes for 163 CVEs across 17 product families, including 8 Critical vulnerabilities, 1 publicly disclosed flaw, and 1 vulnerability under active exploitation. The exploited issue, CVE-2026-32201, is a Microsoft SharePoint Server spoofing vulnerability that can let an unauthenticated attacker impersonate a user and read or modify certain data. Microsoft also patched CVE-2026-33825, a publicly disclosed Microsoft Defender elevation-of-privilege flaw that affects systems only when Defender is enabled; the company said customers using Defender automatic updates are remediated automatically.

Among the most severe issues, Microsoft highlighted CVE-2026-33824, a Critical Windows Internet Key Exchange (IKE) Service Extensions remote code execution vulnerability with a CVSS 9.8, and advised defenders to restrict UDP ports 500 and 4500 until patching is complete. Elevation-of-privilege bugs made up the largest share of the release with 94 CVEs, while Windows accounted for 131 of the patched vulnerabilities. Microsoft said 24 flaws were more likely to be exploited within 30 days, 18 carried CVSS scores of 8.0 or higher, and the release also included 80 Edge-related advisories, most inherited from Chrome.