Browser engine and Office vulnerabilities take centre stage.
April 2026's release was led by browser engine flaws and a cluster of Office document-handling vulnerabilities — the realistic infection vector for most ransomware affecting UK SMEs.
- Risk theme: Edge / Chromium engine RCE
- Risk theme: Office document-handling vulnerabilities
- Risk theme: SMB server elevation of privilege
- Risk theme: Hyper-V guest-to-host escape
The issues that move the needle this month.
We have focused on the categories with realistic exploitation paths for UK SMEs and regulated firms. Always cross-check with Microsoft's Security Update Guide and your own asset inventory before deployment.
Chromium-based Edge remote code execution
A use-after-free in the browser engine could allow code execution from a malicious webpage. Particularly relevant for hybrid workers who browse outside the corporate proxy.
Office document-handling flaws
Multiple parser issues affecting Word and Excel could be triggered by opening a crafted document. Phishing campaigns weaponise this category within days of disclosure.
SMB server elevation of privilege
Permits an authenticated attacker on a file share to escalate to system-level on the host — useful for lateral movement after an initial foothold.
Hyper-V guest-to-host escape
A flaw allowing a malicious guest VM to execute code on the host — critical for any organisation running multi-tenant or shared virtualisation.
Where the risk lives.
- — Microsoft Edge and other Chromium-based browsers
- — Microsoft Office and Microsoft 365 Apps
- — Windows Server (file and Hyper-V roles)
- — Windows 10 and 11 endpoints
What to watch for when rolling out.
- Edge update temporarily reset some site permissions — users may need to re-grant camera/microphone access.
- Reports of Excel add-in failures requiring a repair of the Office installation.
- Hyper-V update increased boot time on hosts with large numbers of VMs.
- Removes a well-known phishing-to-ransomware path via Office documents.
- Hardens browser sandbox — the most exposed application on every endpoint.
- Hyper-V fix protects shared infrastructure from tenant escape.
- Office add-in regressions can disrupt finance and reporting workflows.
- Hyper-V hosts need rolling reboots; HA clusters require planning.
How experienced teams roll these out without drama.
- Force-restart Edge after deployment — many users keep browsers open for weeks.
- Communicate with finance teams before Office updates land; test critical workbooks first.
- Live-migrate VMs off Hyper-V hosts before patching to avoid downtime.
Advice, guidance, or full remediation — your call.
Whether you want a second pair of eyes on this month's release or you would rather hand the entire patching cycle to us, Secure Chain Technology Group can support at any level of involvement.
- Advisory: a prioritised briefing mapped to your estate and risk appetite, with recommended rollout rings.
- Guided deployment: we work alongside your IT team — test plans, rollback procedures and change-management evidence.
- Fully managed remediation: we deploy, validate and report on every patch through our Vulnerability Management-as-a-Service (VMaaS) and Patch Management services.
- Compliance evidence: reporting aligned to Cyber Essentials Plus, ISO 27001 and DSPT requirements.
Get next month's breakdown before you've finished your coffee.
The same practitioner summary you just read — CVE counts, exploited vulnerabilities and rollout guidance — delivered the morning after each Patch Tuesday release.
Always verify against the official Microsoft Security Update Guide and your own asset inventory before deployment.