Microsoft has issued security updates for 78 vulnerabilities, including one actively exploited Zero-Day and one publicly disclosed flaw, as part of the Patch Tuesday updates for March 2026.
Zero-Day Fixed
The most urgent fix this month addresses a vulnerability already being leveraged by attackers in the wild,
Actively Exploited Zero-Day (Elevation of Privilege)
CVE-2026-21262 - SQL Server Elevation of Privilege Vulnerability
Impact - This high-severity flaw (CVSS 8.8) allows an authorized attacker to escalate their privileges to SQL sysadmin over a network. Because it targets core database infrastructure and is currently being exploited, it represents a significant risk for lateral movement and data exfiltration within enterprise environments.
Critical Vulnerabilities to Prioritise
Beyond the zero-day, several vulnerabilities received a "Critical" rating, with particular risk associated with "Zero-Click" exploitation via common productivity tools -
- CVE-2026-26110 & CVE-2026-26113 - Microsoft Office Remote Code Execution - These critical flaws allow for arbitrary code execution simply by viewing a malicious email in the Outlook Preview Pane. No user interaction or file download is required for the system to be compromised.
- CVE-2026-26144 - Microsoft Excel Information Disclosure - A high-impact flaw that could allow an attacker to trigger unintended network egress. Notably, this could be used to cause Microsoft Copilot agents to exfiltrate sensitive heap memory data, enabling a zero-click information disclosure attack.
- CVE-2026-26127 - .NET Denial of Service (Publicly Disclosed) - Although not yet actively exploited, the details of this flaw are public. It allows unauthenticated attackers to remotely crash .NET-based applications, leading to widespread service disruption.
Vulnerabilities by Category
The March 2026 updates addressed a total of 78 flaws, categorised as follows,
- Elevation of Privilege Vulnerabilities - 43
- Remote Code Execution Vulnerabilities - 16
- Information Disclosure Vulnerabilities - 9
- Denial of Service Vulnerabilities - 4
- Spoofing Vulnerabilities - 4
- Security Feature Bypass Vulnerabilities - 2
- Total Flaws - 78
Need Help with Patch Management?
Struggling with relentless patching?
NOCTeam can secure your environment with proactive Patch Management and Endpoint Detection and Response (EDR) services.
Contact us today at [email protected] for a free assessment of your IT systems.
Originally published on LinkedIn.