Patch Tuesday: April 2026 (Expel’s version)

April 2026 Patch Tuesday covers 167 CVEs (including two zero-days) with notable items being a SharePoint spoofing vulnerability (CVE-2026-32201) observed exploited in the wild and a Microsoft Defender elevation-of-privilege (CVE-2026-33825); the report also highlights the Axios NPM supply-chain compromise where malicious postinstall hooks auto-executed and exfiltrated credentials, urging organizations to treat affected systems as compromised and to extend vulnerability management to include dependency integrity.