April 2026 Patch Tuesday — do not sleepwalk into the June 26 Secure Boot deadline

Microsoft released April Patch Tuesday today, April 14, 2026. Expected CVE count lands around 80–100, spread across Windows 11, Office, Exchange, and server components.

The volume is not the story this month. The calendar is.

Secure Boot certificates expire June 26

After June 26, the current Secure Boot certificates stop being valid on Windows 11. Devices without updated certificates will either fail to boot or lose Secure Boot protection entirely. That leaves exactly two Patch Tuesdays to get ahead of the deadline — April and May. After that, no buffer.

If you run Windows 11 24H2, 25H2, or Server 2025, you need a plan in place now.

March's pulled update is a warning

The March release was also a reminder that patch velocity is not free. Microsoft pulled an update within 24 hours after widespread failure reports. Pilot-ring deployment is no longer a best practice — it is a requirement.

What we recommend for Swedish SMBs

For our Microsoft 365 Business Premium customers on Intune Autopatch:

1. Validate April updates in the pilot ring before broad deployment. Budget 48–72 hours.
2. Inventory Secure Boot certificate status across the tenant. Get-SecureBootPolicy and Intune compliance reports give you the answer.
3. Review your Autopatch rings — if you accepted the 2024 defaults, revisit the deferral windows.
4. Plan certificate renewal for May. Do not wait until June.

How HaggeBurger helps

We run a Secure Boot readiness check as a half-day assessment: inventory, patch status, renewal plan ahead of June 26. Existing customers get it folded into the monthly review.

Want us to check your environment? Reach out and we will book it before May.