Wormable Bugs: Microsoft April 2026 Patch Tuesday Fixes Two “Zero-Interaction” RCE Flaws

**Urgent Windows wormable vulnerabilities:** Microsoft’s April 2026 Patch Tuesday fixes two high-risk, wormable RCE vulnerabilities—CVE-2026-33827 (TCP/IP stack, CVSS 8.1; requires IPv6+IPSec and a race condition) and CVE-2026-33824 (IKEv2 service extensions, CVSS 9.8)—which allow unauthenticated attackers to propagate across networks without user interaction; administrators are urged to prioritize patches and block UDP 500/4500 at the perimeter to mitigate exploitation and lateral spread.