Microsoft March 2026 Patch Fixes 79 Vulnerabilities, Eight Critical, Two Publicly Disclosed Zero-Days

Microsoft fixed 79 security flaws in its March 2026 Patch Tuesday update. This release includes eight critical bugs and two publicly disclosed zero-day vulnerabilities. Neither zero-day has been observed exploited in the wild, but public disclosure significantly raises the risk of attackers developing exploits.

The update patches flaws in Windows, Office, Excel, SharePoint, SQL Server, .NET, Azure, Hyper-V, Edge, and other components that allow attackers to run code, gain higher privileges, disclose information, or cause denial of service.

Publicly disclosed zero-day flaws:

• CVE-2026-21262 — SQL Server Elevation of Privilege Vulnerability. Publicly disclosed before a patch was available. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network, potentially gaining SQL administrator privileges. Credited to security researcher Erland Sommarskog, who originally disclosed the flaw in the "Packaging Permissions in Stored Procedures" article. Organizations running SQL Server in corporate infrastructure should apply this patch as soon as possible.
• CVE-2026-26127 — .NET Denial of Service Vulnerability. Publicly disclosed before a patch was available. An out-of-bounds read in .NET allows an unauthorized attacker to trigger a denial-of-service condition over a network, potentially causing applications built on the .NET platform to crash or become unresponsive. Attributed to an anonymous researcher.

Critical flaws:

• CVE-2026-26110 — Microsoft Office Remote Code Execution Vulnerability (Critical). A type confusion issue caused by access to a resource using an incompatible type that could allow an unauthorized attacker to execute code locally. Exploitable via the Office preview pane, meaning users could be exposed simply by previewing a malicious document without fully opening it.
• CVE-2026-26113 — Microsoft Office Remote Code Execution Vulnerability (Critical). An untrusted pointer dereference that could allow an unauthorized attacker to execute code locally. Also exploitable via the preview pane, reducing the need for user interaction and making phishing campaigns more effective. Organizations should prioritize patching Office systems immediately.
• CVE-2026-26144 — Microsoft Excel Information Disclosure Vulnerability (Critical). Improper neutralization of input in Microsoft Excel could enable an unauthorized attacker to disclose information. Of particular concern, this flaw could be used to exfiltrate data via Microsoft Copilot. An attacker who successfully exploited this vulnerability could potentially cause Copilot Agent mode to exfiltrate data via unintended network egress, enabling a zero-click information disclosure attack. This flaw highlights growing security concerns around AI integrations in productivity software.
• CVE-2026-23651 — Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
• CVE-2026-26124 — Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
• CVE-2026-26122 — Microsoft ACI Confidential Containers Information Disclosure Vulnerability
• CVE-2026-21536 — Microsoft Devices Pricing Program Remote Code Execution Vulnerability
• CVE-2026-26125 — Payment Orchestrator Service Elevation of Privilege Vulnerability
• CVE-2026-3381 —  Mariner Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

Flaws rated "more likely" to be exploited:

Cisco Talos has highlighted several vulnerabilities rated "important" but assessed by Microsoft as "more likely" to be exploited:

• CVE-2026-23668 — Windows Graphics Component Elevation of Privilege Vulnerability
• CVE-2026-24289 — Windows Kernel Elevation of Privilege Vulnerability
• CVE-2026-24291 — Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability
• CVE-2026-24294 — Windows SMB Server Elevation of Privilege Vulnerability
• CVE-2026-25176 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
• CVE-2026-25187 — Winlogon Elevation of Privilege Vulnerability

The patch cycle includes:

• 46 Elevation of Privilege vulnerabilities
• 2 Security Feature Bypass vulnerabilities
• 18 Remote Code Execution vulnerabilities
• 10 Information Disclosure vulnerabilities
• 4 Denial of Service vulnerabilities
• 4 Spoofing vulnerabilities

Full patch list