Microsoft’s March 2026 Patch Tuesday addresses 79 security vulnerabilities. While no vulnerabilities were under active exploit at the time of release, two zero-day vulnerabilities were publicly disclosed prior to the updates. The release is dominated by Elevation of Privilege (EoP) flaws, which account for approximately 55% to 58% of the total bugs.
Severity: Critical
Overall Patch Release
- Microsoft released security updates for ~79 vulnerabilities across Windows, Office, Azure, SQL Server, Hyper-V, Edge (Chromium), and related components.
- Including third-party/Chromium fixes, the total rises to ~94 CVEs.
- 8 vulnerabilities are rated Critical, while the majority are Important severity.
- Two vulnerabilities were publicly disclosed before patches were released, though none were reported as actively exploited at release time.
Publicly Disclosed Zero-Days
- CVE-2026-21262 (SQL Server EoP): An authorized attacker can elevate privileges to sysadmin over a network. It affects SQL Server 2016 and later.
- CVE-2026-26127 (.NET DoS): An out-of-bounds read vulnerability that allows an unauthorized attacker to deny service over a network.
Critical Vulnerabilities
- CVE-2026-26110 & CVE-2026-26113 (Microsoft Office RCE): These critical flaws can be triggered via the Preview Pane by viewing a specially crafted message, making them highly dangerous for phishing campaigns.
- CVE-2026-26144 (Microsoft Excel Info Disclosure): A “zero-click” vulnerability where an attacker can use a cross-site scripting (XSS) bug to cause a Copilot Agent to exfiltrate data from the target system.
- CVE-2026-21536 (Microsoft Devices Pricing Program RCE): Notable as one of the first vulnerabilities discovered by an autonomous AI agent (XBOW) and officially recognized with a CVE. This was an “out-of-band” fix that required no user action.
Notable “More Likely To Be Exploited” Flaws
Microsoft identified several Elevation of Privilege bugs as more likely targets for attackers:
- CVE-2026-24291: Windows Accessibility Infrastructure (ATBroker.exe).
- CVE-2026-24294: Windows SMB Server.
- CVE-2026-24289: Windows Kernel (memory corruption/race condition).
- CVE-2026-25187: Winlogon (discovered by Google Project Zero).
- CVE-2026-23669: Windows Print Spooler RCE; authenticated attackers can gain code execution without user interaction.
Recommendations
- Apply the March 2026 Microsoft security updates across all affected systems.
- Prioritize patching CVE-2026-26110 and CVE-2026-26113 (Office) and CVE-2026-23669 (Print Spooler) due to their RCE potential without user interaction.
- Disable Outlook Preview Pane for high-risk environments where feasible.
- Enable Safe Attachments and Safe Links policies in Microsoft Defender.
- Disable the Print Spooler service on servers and domain controllers where printing is not required.
Source:
- https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/
- https://www.zerodayinitiative.com/blog/2026/3/10/the-march-2026-security-update-review
- https://krebsonsecurity.com/2026/03/microsoft-patch-tuesday-march-2026-edition/
- https://blog.talosintelligence.com/microsoft-patch-tuesday-march-2026/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21536
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21262
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-26127
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25187
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24289
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294
- https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.