Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws

Today is Microsoft’s March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

This Patch Tuesday also addresses three “Critical” vulnerabilities, 2 of which are remote code execution flaws and the other is an information disclosure flaw.

The number of bugs in each vulnerability category is listed below:

• 46 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 18 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 4 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include 9 Microsoft Edge flaws, Mariner, Payment Orchestrator Service, Azure, and Microsoft Devices ;./ricing Program flaws fixed earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5079473 & KB5078883 cumulative updates and the Windows 10 KB5078885 extended security update.

2 zero-days and Microsoft Office flaws

This month’s Patch Tuesday fixes two publicly disclosed zero-day vulnerabilities, with none of them known to be exploited in attacks.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The two publicly disclosed zero-days are:

CVE-2026-21262 – SQL Server Elevation of Privilege Vulnerability

Microsoft has patched a publicly disclosed SQL Server elevation-of-privilege flaw that grants SQLAdmin privileges.

“Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network,” explains Microsoft.

Microsoft has credited Erland Sommarskog with discovering this flaw, who told BleepingComputer that the flaw was originally disclosed in the “Packaging Permissions in Stored Procedures” article.

CVE-2026-26127 – .NET Denial of Service Vulnerability

Microsoft has patched a publicly disclosed .NET denial of service flaw.

“Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network,” explains Microsoft.

This flaw was attributed to an anonymous researcher.

Microsoft has also fixed two remote code execution bugs (CVE-2026-26110 and CVE-2026-26113), both in Microsoft Office, which can be exploited via the preview pane. Therefore, users should prioritize updating the application.

Of particular interest is the Microsoft Excel information disclosure flaw (CVE-2026-26144), as it could be used to exfiltrate data via Microsoft Copilot.

“An attacker who successfully exploited this vulnerability could potentially cause Copilot Agent mode to exfiltrate data via unintended network egress, enabling zero-click information disclosure attack,” explains Microsoft.

Recent updates from other companies

Other vendors who released updates or advisories in March 2026 include:

• Adobe released security updates for Commerce, Illustrator, Substance 3D Painter, Acrobat Reader, Premiere Pro, and more. None of the flaws are tagged as exploited.
• Cisco released security updates for numerous products.
• Fortinet released security updates for FortiOS, FortiPAM, and FortiProxy.
• Google released Android’s March security bulletin, which fixed an actively exploited zero-day flaw in a Qualcomm display component.
• HPE fixed multiple vulnerabilities in HPE Aruba Networking AOS-CX.
• SAP released the March security updates for multiple products, including fixes for two critical vulnerabilities.

The March 2026 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the March 2026 Patch Tuesday updates.