Microsoft’s March 2026 Patch Tuesday Fixes 79 Vulnerabilities, Including Two Disclosed Zero-Days
Summary
Microsoft’s March 2026 updates address 79 vulnerabilities across products, including two publicly disclosed zero-days; Microsoft reported no evidence they were exploited. The release also fixes critical Office RCE and Excel/Copilot information-disclosure flaws.
Key points
- The updates address 79 vulnerabilities across SQL Server, .NET, Office, SharePoint Server, Azure services and Windows components.
- The two publicly disclosed zero-days are CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET. Microsoft reported no evidence of in-the-wild exploitation and said exploitation of the .NET flaw appears unlikely.
- CVE-2026-21262 could let an attacker with authorized network access escalate privileges in SQL Server; the article reports a CVSS score of 8.8.
- Two critical Microsoft Office remote-code-execution flaws can be triggered through the Preview Pane.
- CVE-2026-26144 is a critical Excel information-disclosure flaw that could let Copilot Agent send data through unintended network connections. Microsoft said exploitation was unlikely and no exploit code was known; analysts noted a document must be opened.
- SharePoint fixes include remote-code-execution flaws affecting authenticated users with Site Member permissions. An Azure MCP Server Tools SSRF flaw could expose a managed identity token.
- CVE-2026-26128 affects Windows SMB Server and could allow privilege escalation to SYSTEM.
Article Details
- Event Type
- Microsoft Patch Tuesday security update addressing vulnerabilities across multiple products.
- Impact
- Microsoft reported fixing 79 vulnerabilities, including three critical issues and two publicly disclosed zero-days. The zero-days were CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET; Microsoft reported no evidence of real-world exploitation. The update also addresses critical Office remote-code-execution vulnerabilities that can be triggered through the Preview Pane, an Excel information-disclosure flaw that could enable Copilot Agent to exfiltrate data through unintended network egress, and vulnerabilities affecting SharePoint Server, Azure MCP Server Tools, and Windows components. CVE-2026-26144 has no known exploit code, and Microsoft assessed exploitation as unlikely.
CVE
CVE-2026-21262Microsoft · Microsoft SQL Server 2016 Service Pack 3 (GDR); Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack; +8 moreNotable fixes include CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26144 (Excel Copilot zero-click information disclosure), and administrators are urged to apply updates immediately to mitigate remoteCVE-2026-26109Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Excel 2016; +6 moreAnother Office-related issue, CVE-2026-26109, is an “Important” vulnerability in Excel caused by an out-of-bounds read.CVE-2026-26118Microsoft · Azure MCP Server Tools 1.0.0 (npm); Microsoft · Azure MCP Server Tools 1.0.0 (NuGet); +3 moreAnother issue, CVE-2026-26118, affects Azure MCP Server Tools.CVE-2026-26127Microsoft · .NET 10.0; Microsoft · .NET 9.0; +1 moreTwo publicly disclosed zero-days are CVE-2026-21262 (SQL Server) and CVE-2026-26127 (.NET).CVE-2026-26128Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreOne such flaw, CVE-2026-26128, affects Windows SMB Server and allows attackers to gain SYSTEM privileges if successfully exploited.CVE-2026-26144Microsoft · Microsoft 365 Apps for EnterpriseNotable fixes include CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26144 (Excel Copilot zero-click information disclosure), and administrators are urged to apply updates immediately to mitigate remote
People
Vendors
Products
.NETMicrosoft’s Patch Tuesday March 2026 rollout fixes 79 vulnerabilities across SQL Server, .NET, Office, SharePoint Server, and Azure, including three critical bugs and two publicly disclosed zero-days.Azure MCP Server ToolsAnother issue, CVE-2026-26118, affects Azure MCP Server Tools.Copilot AgentCVE-2026-26144 is a critical Excel information disclosure that can weaponize Copilot Agent for zero-click data exfiltration.ExcelNotable fixes include CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26144 (Excel Copilot zero-click information disclosure), and administrators are urged to apply updates immediately to mitigate remoteMicrosoft OfficeTwo critical remote code execution bugs in Microsoft Office can be triggered via the Preview Pane.SharePoint ServerMicrosoft’s Patch Tuesday March 2026 rollout fixes 79 vulnerabilities across SQL Server, .NET, Office, SharePoint Server, and Azure, including three critical bugs and two publicly disclosed zero-days.SQL ServerMicrosoft’s Patch Tuesday March 2026 rollout fixes 79 vulnerabilities across SQL Server, .NET, Office, SharePoint Server, and Azure, including three critical bugs and two publicly disclosed zero-days.Windows SMB ServerOne such flaw, CVE-2026-26128, affects Windows SMB Server and allows attackers to gain SYSTEM privileges if successfully exploited.