Microsoft’s March 2026 Patch Tuesday Fixes 79 Flaws, Including Two Publicly Disclosed Zero-Days
Summary
Microsoft’s March 2026 updates fix 79 flaws, including two publicly disclosed zero-days not known to be exploited. Highlights include Office preview-pane RCEs and an Excel flaw that could enable Copilot data exfiltration.
Key points
- Microsoft patched 79 vulnerabilities: 46 elevation-of-privilege, 18 remote code execution, 10 information disclosure, four denial-of-service, four spoofing, and two security-feature-bypass flaws.
- The two publicly disclosed zero-days are SQL Server privilege-escalation flaw CVE-2026-21262 and .NET denial-of-service flaw CVE-2026-26127; neither was known to be exploited in attacks.
- Three vulnerabilities were rated Critical, including two remote code execution flaws and one information-disclosure flaw.
- Office RCE vulnerabilities CVE-2026-26110 and CVE-2026-26113 can be exploited through the preview pane.
- Excel information-disclosure flaw CVE-2026-26144 could allow Copilot Agent mode to exfiltrate data through unintended network egress.
- Adobe, Cisco, Fortinet, Google, HPE, and SAP also issued security updates in March; Google’s Android bulletin included an actively exploited Qualcomm display-component zero-day.
Article Details
- Event Type
- Microsoft March 2026 Patch Tuesday security update
- Impact
- Microsoft fixed 79 vulnerabilities, including two publicly disclosed zero-days that were not known to be exploited in attacks, and three Critical flaws. The updates address a SQL Server privilege-escalation flaw, a .NET denial-of-service flaw, two Office remote-code-execution flaws exploitable through the preview pane, and an Excel information-disclosure flaw that could enable Copilot Agent mode to exfiltrate data through unintended network egress.
CVE
CVE-2026-21262Microsoft · Microsoft SQL Server 2016 Service Pack 3 (GDR); Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack; +8 moreTwo publicly disclosed zero-days were patched: CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET.CVE-2026-26110Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2016; +6 moreTwo Office RCEs (CVE-2026-26110 and CVE-2026-26113) are exploitable via the preview pane, and an Excel bug (CVE-2026-26144) could enable Copilot-based data exfiltration.CVE-2026-26113Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2016; +8 moreTwo Office RCEs (CVE-2026-26110 and CVE-2026-26113) are exploitable via the preview pane, and an Excel bug (CVE-2026-26144) could enable Copilot-based data exfiltration.CVE-2026-26127Microsoft · .NET 10.0; Microsoft · .NET 9.0; +1 moreTwo publicly disclosed zero-days were patched: CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET.CVE-2026-26144Microsoft · Microsoft 365 Apps for EnterpriseTwo Office RCEs (CVE-2026-26110 and CVE-2026-26113) are exploitable via the preview pane, and an Excel bug (CVE-2026-26144) could enable Copilot-based data exfiltration.
People
Vendors
AdobeOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.CiscoOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.FortinetOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.GoogleOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.Hewlett Packard EnterpriseOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.MicrosoftMicrosoft’s March 2026 Patch Tuesday fixes 79 vulnerabilities, including two publicly disclosed zero-days and three Critical flaws affecting Windows, Office, Azure, and related components.SAPOther vendors including Adobe, Cisco, Fortinet, Google, HPE, and SAP also released security updates in March 2026.
Products
.NETKey patches include a SQL Server elevation-of-privilege zero-day, a .NET denial-of-service zero-day, two Office remote code execution bugs exploitable via the preview pane, and an Excel information-disclosure flaw thatAzureMicrosoft’s March 2026 Patch Tuesday fixes 79 vulnerabilities, including two publicly disclosed zero-days and three Critical flaws affecting Windows, Office, Azure, and related components.Microsoft CopilotOf particular interest is the Microsoft Excel information disclosure flaw (CVE-2026-26144), as it could be used to exfiltrate data via Microsoft Copilot.Microsoft ExcelOf particular interest is the Microsoft Excel information disclosure flaw (CVE-2026-26144), as it could be used to exfiltrate data via Microsoft Copilot.Microsoft Office2 zero-days and Microsoft Office flawsMicrosoft WindowsMicrosoft’s March 2026 Patch Tuesday fixes 79 vulnerabilities, including two publicly disclosed zero-days and three Critical flaws affecting Windows, Office, Azure, and related components.SQL ServerKey patches include a SQL Server elevation-of-privilege zero-day, a .NET denial-of-service zero-day, two Office remote code execution bugs exploitable via the preview pane, and an Excel information-disclosure flaw that