Microsoft Patches 83 Vulnerabilities in March 2026 Update
Summary
Microsoft patched 83 vulnerabilities in its March 2026 updates; none were flagged as exploited. The article highlights publicly disclosed flaws, an Azure MCP Server Tools issue that could expose a managed identity token, and patching considerations.
Key points
- Microsoft announced fixes for 83 vulnerabilities; none were flagged as exploited, though two had been publicly disclosed.
- CVE-2026-26118 in Azure MCP Server Tools could let an attacker who can interact with an MCP-backed agent submit a malicious URL and capture a managed identity token, Microsoft says.
- CVE-2026-21536, a critical remote code execution flaw in Devices Pricing Program, was already fully mitigated by Microsoft; the company said users need take no action.
- Microsoft also addressed vulnerabilities in Windows components and Azure products; some Azure flaws require non-standard patching mechanisms.
- Microsoft announced fixes for 10 non-Microsoft CVEs, including one in Semantic Kernel Python SDK and nine in Microsoft Edge.
- Adobe separately announced patches for 80 vulnerabilities, including high-severity flaws in Adobe Commerce.
Article Details
- Event Type
- Microsoft March 2026 Patch Tuesday vulnerability fixes
- Impact
- Microsoft announced patches for 83 vulnerabilities across its products. None were flagged as exploited, though two had been publicly disclosed. The updates include one critical remote-code-execution flaw that Microsoft says is already fully mitigated, and an Azure MCP Server Tools vulnerability that could expose a managed identity token to an attacker able to interact with the MCP-backed agent. Some Azure flaws require non-standard patching mechanisms. Microsoft also announced fixes for 10 non-Microsoft CVEs.
CVE
CVE-2026-21262Microsoft · Microsoft SQL Server 2016 Service Pack 3 (GDR); Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack; +8 moreThese include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server.CVE-2026-21536Microsoft · Microsoft Devices Pricing ProgramMicrosoft’s March 2026 Patch Tuesday updates resolve a single critical-severity flaw, namely CVE-2026-21536 (CVSS score of 9.8), a remote code execution weakness in Devices Pricing Program that has already been fullyCVE-2026-23661Microsoft · Azure IoT Explorerand one spoofing and three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661, CVE-2026-23662, and CVE-2026-23664).CVE-2026-23662Microsoft · Azure IoT Explorerand three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661, CVE-2026-23662, and CVE-2026-23664).CVE-2026-23664Microsoft · Azure IoT Explorerdisclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661, CVE-2026-23662, and CVE-2026-23664).CVE-2026-23665Microsoft · Azure Linux Virtual Machines with Azure Diagnostics extensionThese include an elevation of privilege issue in Azure Linux Virtual Machines (CVE-2026-23665), and one spoofing and three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661,CVE-2026-26118Microsoft · Azure MCP Server Tools 1.0.0 (npm); Microsoft · Azure MCP Server Tools 1.0.0 (NuGet); +3 moreAnother security defect that stands out is CVE-2026-26118, an elevation of privilege issue in Azure MCP Server Tools that could be exploited by sending specially crafted input to a server tool that accepts user-suppliedCVE-2026-26121Microsoft · Azure IoT Explorer(CVE-2026-23665), and one spoofing and three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661, CVE-2026-23662, and CVE-2026-23664).CVE-2026-26127Microsoft · .NET 10.0; Microsoft · .NET 9.0; +1 moreThese include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server.
People
Satnam NarangTenable researcher who commented on the likelihood of exploitation of the publicly disclosed vulnerabilities and noted that some Windows privilege-escalation flaws may require attention.Tyler RegulyFortra associate director who advised users to pay attention to Azure security defects and highlighted their non-standard patching mechanisms.
Vendors
Products
.NETThese include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server.Azure IoT ExplorerLinux Virtual Machines (CVE-2026-23665), and one spoofing and three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661, CVE-2026-23662, and CVE-2026-23664).Azure Linux Virtual MachinesThese include an elevation of privilege issue in Azure Linux Virtual Machines (CVE-2026-23665), and one spoofing and three information disclosure flaws in Azure IoT Explorer (CVE-2026-26121, CVE-2026-23661,Azure MCP Server ToolsAnother security defect that stands out is CVE-2026-26118, an elevation of privilege issue in Azure MCP Server Tools that could be exploited by sending specially crafted input to a server tool that accepts user-suppliedDevices Pricing Programflaw, namely CVE-2026-21536 (CVSS score of 9.8), a remote code execution weakness in Devices Pricing Program that has already been fully mitigated by the tech giant.SQL ServerThese include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server.Windows Accessibility InfrastructureNarang says that the privilege escalation bugs in Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon may require attention, as such vulnerabilities areWindows Graphics ComponentNarang says that the privilege escalation bugs in Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon may require attention, as such vulnerabilities areWindows Kernelthe privilege escalation bugs in Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon may require attention, as such vulnerabilities are often exploitedWindows SMB Serverbugs in Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon may require attention, as such vulnerabilities are often exploited following initialWinlogonGraphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon may require attention, as such vulnerabilities are often exploited following initial access.