Microsoft's March Patch Tuesday Addresses 84 Vulnerabilities, Including Two Publicly Disclosed Zero-Days

Microsoft's March 2026 Patch Tuesday addressed a substantial set of 84 security vulnerabilities across its software portfolio, including two zero-day vulnerabilities that had already been publicly disclosed. Among the patched flaws, eight were rated Critical severity, while 76 were deemed Important, highlighting the ongoing challenge of maintaining security across Microsoft's extensive ecosystem.

Scope and Distribution of Vulnerabilities

The vulnerabilities patched this month span multiple categories, with privilege escalation bugs being the most prevalent at 46 cases. Other significant categories included:

• 18 remote code execution flaws
• 10 information disclosure vulnerabilities
• 4 spoofing issues
• 4 denial-of-service vulnerabilities
• 2 security feature bypass bugs

"This month, over half (55%) of all Patch Tuesday CVEs were privilege escalation bugs, and of those, six were rated exploitation more likely across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon," explained Satnam Narang, senior staff research engineer at Tenable. "We know these bugs are typically used by threat actors as part of post-compromise activity, once they get onto systems through other means (social engineering, exploitation of another vulnerability)."

Critical Zero-Day Vulnerabilities

Two zero-day vulnerabilities were addressed this month that had already been publicly disclosed:

1. CVE-2026-26127 (CVSS score: 7.5) - A denial-of-service vulnerability in .NET
2. CVE-2026-21262 (CVSS score: 8.8) - An elevation of privilege vulnerability in SQL Server

Notable Vulnerabilities Requiring Attention

Several vulnerabilities stood out due to their severity and potential impact:

Winlogon Privilege Escalation (CVE-2026-25187)

With a CVSS score of 7.8, this vulnerability leverages improper link resolution to obtain SYSTEM privileges. Google Project Zero researcher James Forshaw was credited with discovering this flaw.

"The flaw allows a locally authenticated attacker with low privileges to exploit a link-following condition in the Winlogon process and escalate to SYSTEM privileges," said Jacob Ashdown, cybersecurity engineer at Immersive. "The vulnerability requires no user interaction and has low attack complexity, making it a straightforward target once an attacker gains a foothold."

Azure Model Context Protocol Server-Side Request Forgery (CVE-2026-26118)

This critical vulnerability (CVSS score: 8.8) in Azure's Model Context Protocol (MCP) server could allow authorized attackers to elevate privileges over a network. Microsoft explained that an attacker could exploit this by sending specially crafted input to an Azure MCP Server tool that accepts user-provided parameters.

"If the attacker can interact with the MCP-backed agent, they can submit a malicious URL in place of a normal Azure resource identifier. The MCP Server then sends an outbound request to that URL and, in doing so, may include its managed identity token. This allows the attacker to capture that token without requiring administrative access," Microsoft detailed in their advisory.

Excel Information Disclosure (CVE-2026-26144)

This Critical-severity flaw (CVSS score: 7.5) involves cross-site scripting that occurs as a result of improper neutralization of input during web page generation. An attacker could potentially cause Copilot Agent mode to exfiltrate data as part of a zero-click attack.

"Information disclosure vulnerabilities are especially dangerous in corporate environments where Excel files often contain financial data, intellectual property, or operational records," warned Alex Vovk, CEO and co-founder of Action1. "If exploited, attackers could silently extract confidential information from internal systems without triggering obvious alerts. Organizations using AI-assisted productivity features may face increased exposure, as automated agents could unintentionally transmit sensitive data outside corporate boundaries."

Highest Severity Vulnerability

The vulnerability with the highest CVSS score in this month's update is CVE-2026-21536, a critical remote code execution flaw in the Microsoft Devices Pricing Program with a CVSS score of 9.8. Fortunately, Microsoft reported that this issue has been fully mitigated, and no action is required from users. The AI-powered autonomous vulnerability discovery platform XBOW was credited with discovering and reporting this issue.

Additional Edge Browser Updates

In addition to the 84 vulnerabilities patched in the main update, Microsoft also addressed 10 vulnerabilities in its Chromium-based Edge browser since the February 2026 Patch Tuesday update. These additional fixes highlight the ongoing security challenges in maintaining a secure browser codebase.

Windows Autopatch Changes

Microsoft announced changes to the default behavior of Windows Autopatch by enabling hotpatch security updates to help secure devices at a faster pace.

"This change in default behavior comes to all eligible devices in Microsoft Intune and those accessing the service via Microsoft Graph API starting with the May 2026 Windows security update," Microsoft stated. "Applying security fixes without requiring a restart can get organizations to 90% compliance in half the time, while you remain in control."

Recommendations for Organizations

Given the number of privilege escalation vulnerabilities patched this month, organizations should prioritize applying these updates promptly, particularly for systems with public exposure or containing sensitive data. The Winlogon vulnerability, in particular, should be addressed quickly due to its potential for easy exploitation once an attacker gains initial access.

For Azure environments, administrators should review MCP server configurations and ensure proper access controls are in place until the relevant updates can be applied. Organizations should also consider the implications of Excel's information disclosure vulnerability, especially those handling sensitive data in spreadsheet files.

The introduction of hotpatch capabilities represents a significant improvement in Microsoft's patch deployment strategy, which may help organizations reduce their vulnerability window by eliminating the need to wait for scheduled restarts to apply critical security updates.