Patch SharePoint Server first — CVE-2026-32201 is being exploited in the wild right now. Then close the Defender 'BlueHammer' elevation flaw (CISA KEV-listed eight days after release, now used by ransomware gangs) and the unauthenticated, wormable 9.8 IKE remote-code-execution bug. Three separate emergency changes.

Why now. CVE-2026-32201 was exploited in the wild as a zero-day at release — Microsoft flags it exploited, Rapid7 and SecurityAffairs mark it 'Exploitation Detected'. It is a spoofing / improper-input-validation flaw on an internet-facing collaboration server, so the asset is directly reachable and the attack is already happening. It scores only 6.5, which means a queue ordered by CVSS files it below dozens of higher-scored bugs nobody is being attacked through — the exploitation is the entire signal, and it forces the emergency change.

This unit cannot slip. Assessed to cut 0 of the identified chains — see the cut section, where this is labelled as a judgement rather than a finding.

Also inside: Some counters describe the impact as XSS-like — view or change disclosed information — rather than full code execution; the exploitation status, not the impact ceiling, is what makes this rank 1. Treat any public-facing SharePoint farm as the priority; internal-only farms are still Act but a shorter blast radius.

Patching is not remediation. CVE-2026-32201 was exploited before you could patch, so deploying the SharePoint update is remediation of the vulnerability, not of any intrusion that already used it. Hunt public-facing farms for anomalous authentication, unexpected content or permission changes, and web-shell artefacts in the exposure window — a spoofing entry point is typically the first move of a longer chain, not the objective.

Then. Apply the SharePoint security update for your edition (Subscription Edition / 2019 / 2016) to every farm server and run the SharePoint Products Configuration Wizard or PSConfig so the build is committed across the farm — a half-patched farm is still exposed. Prioritise internet-reachable farms.

Why now. CVE-2026-33825 — 'BlueHammer' — elevates a local foothold to SYSTEM through a time-of-check/time-of-use race in Defender's threat-remediation engine. It was publicly disclosed with proof-of-concept code at release, CISA added it to KEV on 22 April (eight days after the patch), and by late June ransomware gangs were exploiting it. It is an EoP, not a remote entry point, but it is confirmed exploited and KEV-listed — evidence lane, emergency change. It ranks below SharePoint only because SharePoint is the internet-facing entry point and this is the escalation stage.

This unit cannot slip. Assessed to cut 0 of the identified chains — see the cut section, where this is labelled as a judgement rather than a finding.

Patching is not remediation. Public PoC existed at release and exploitation began within days, so any host that stayed on an old Defender platform build through late April sat in a window where a foothold could become SYSTEM. Verify the platform version that was actually running during that window rather than the version running today; where it lagged, hunt for privilege-escalation and remediation-tampering artefacts.

Then. Confirm Defender's antimalware platform auto-updated to 4.18.26030.3011 or later (Get-MpComputerStatus → AMProductVersion / AMEngineVersion). On most estates Defender platform updates deploy automatically, but air-gapped, WSUS-pinned or MDM-managed endpoints can lag — those are the ones to check by hand.

Why now. CVE-2026-33824 lets an unauthenticated remote attacker execute code by sending crafted packets to any Windows host with IKEv2 enabled (UDP 500/4500), with wormable potential per SecurityAffairs and ZDI. It is the highest-scored flaw of the month (9.8) and the worst ceiling. It ranks third only because no source reports it exploited or publicly disclosed — the structural lane sits below the evidence lane by design. That ordering is a triage rule, not a downgrade: this is still an Act / 72-hour change, and for any internet-exposed IKEv2 endpoint it is a co-lead with SharePoint.

This unit cannot slip. Assessed to cut 0 of the identified chains — see the cut section, where this is labelled as a judgement rather than a finding.

Also inside: The same cumulative closes seven other Critical flaws this cycle; only IKE is confirmed at 9.8. Six further Critical RCEs (CVE-2026-33827, -32157, -32190, -33114, -33115, -33826) are Critical but their individual scores were not established in the source set — do not assume any is 9.8.

Then. Deploy the per-product package for your build and reboot. As mitigation ahead of the reboot, block UDP 500/4500 from untrusted networks at the perimeter and disable IKEv2 where it is not required. STAGE FIRST: Server 2025 (KB5082063) shipped with install failures (OOB KB5091157) and Server 2022/2019 with LSASS/domain-controller restart-loop issues (OOB KB5091575 / KB5091573) — canary these before the fleet.