Last Night We Wrote That AI Would Overwhelm the Patch Pipeline. This Morning Microsoft Dropped Its Second-Largest Patch Tuesday Ever. 167 Vulnerabilities. Two Zero-Days. And the Head of ZDI Says AI Has Tripled Their Submission Rate.

THE AI VOLUME SIGNAL

Last night we published our analysis of Anthropic's Claude Mythos and Project Glasswing. The core argument was that AI-powered vulnerability discovery would overwhelm the defensive patch pipeline because human remediation capacity cannot keep pace with machine-scale discovery. We noted that over 99% of Mythos' findings were still unpatched at the time of announcement.

This morning, Dustin Childs at Trend Micro's Zero Day Initiative confirmed the real-world version of exactly that problem. In his analysis of April's Patch Tuesday, Childs noted that vulnerability submissions driven by AI tools have essentially tripled their incoming rate, making triage "a challenge, to say the least." ZDI is the largest vendor-agnostic vulnerability disclosure program in the world. When they say AI is tripling their volume, that is the single most authoritative signal that the vulnerability discovery landscape has structurally changed.

The connection between last night's Mythos analysis and this morning's patch volume is not coincidental. It is the same phenomenon at different points in the pipeline. Mythos represents the frontier capability. ZDI's tripled submission rate represents the effect of earlier, less capable AI tools already in wide use. Microsoft's second-largest Patch Tuesday ever represents what happens when that volume reaches the vendor. And the 167 vulnerabilities your team needs to patch by end of week represents where the pressure lands.

THE ZERO-DAYS

CVE-2026-32201: SharePoint Server Spoofing (CVSS 6.5, actively exploited). This is the priority patch. Despite a moderate CVSS score, it is confirmed under active exploitation and CISA added it to the Known Exploited Vulnerabilities catalog within hours of disclosure. The flaw stems from improper input validation and allows unauthenticated attackers to perform spoofing over a network against SharePoint environments. For any organization running on-premises SharePoint 2016, 2019, or Subscription Edition for document management and collaboration, this is an immediate patching requirement. The CVSS score understates the real-world risk because SharePoint is a high-value target that stores sensitive documents and facilitates internal workflows.

CVE-2026-33825: Microsoft Defender Elevation of Privilege (CVSS 7.8, publicly disclosed). This vulnerability allows attackers to escalate privileges to SYSTEM level locally. Tenable's analysis notes that the vulnerability description matches the BlueHammer proof-of-concept exploit published on GitHub on April 3 by a researcher using the alias "Chaotic Eclipse." The researcher released the exploit after expressing frustration with Microsoft's vulnerability disclosure process. The fix is delivered through Defender Antimalware Platform version 4.18.26050.3011, which updates automatically. Verify your Defender version to confirm you have the fix.

The BlueHammer story is worth pausing on. A researcher found a SYSTEM-level privilege escalation in Microsoft Defender, reported it through proper channels, felt Microsoft did not respond adequately, and published a working exploit to GitHub. Twelve days later, Microsoft patched it. That timeline reveals a disclosure process under strain. When researchers lose confidence in vendor responsiveness, they go public. When they go public, attackers get working exploit code before the patch ships. This is exactly the kind of pressure that increases as AI-driven discovery floods disclosure pipelines with more findings than vendors can process.

WHAT ELSE SHIPPED

Beyond the two zero-days, this Patch Tuesday addresses eight Critical-severity vulnerabilities, seven of which are remote code execution flaws. The vulnerability breakdown by category: elevation of privilege accounts for 57% of the total, followed by information disclosure and remote code execution at 12% each. Twenty remote code execution vulnerabilities were fixed across Windows, Office, Remote Desktop Services, and other core components.

Also released this cycle: Fortinet shipped security updates including a patch for the critical FortiClient EMS vulnerability we covered in our April 7 post. CISA added that flaw (CVE-2026-21643, CVSS 9.1, SQL injection) to its KEV catalog alongside the SharePoint zero-day. Google also patched a Chrome zero-day that was exploited in attacks. SAP released April security updates including a critical SQL injection vulnerability. This is a week where every major vendor shipped critical patches simultaneously.

INDICATORS AND PATCH PRIORITIES

WHAT TO DO RIGHT NOW