Microsoft Patch Fixes 78 Vulnerabilities Including One Zero-Day

The latest Microsoft Patch Tuesday update released on March 10, 2026, fixes 78 security vulnerabilities affecting Windows, Microsoft Office, Azure, SQL Server, and .NET. Among the fixes is one actively exploited zero-day vulnerability, making this Microsoft Patch release particularly important for organizations and security teams.

Security experts are urging organizations to deploy the Microsoft Patch update immediately, especially due to the presence of a zero-day vulnerability and several Critical-rated flaws across widely used Microsoft products.

Zero-Day Vulnerability Requires Immediate Attention

The most critical issue addressed in this Microsoft Patch update is CVE-2026-21262, a SQL Server Elevation of Privilege vulnerability that is currently being actively exploited. Microsoft has not attributed the attacks to any specific threat actor.

The presence of this zero-day vulnerability highlights the urgency of applying the Microsoft Patch update across affected systems.

Another vulnerability, CVE-2026-26127, a .NET Denial of Service flaw, has been publicly disclosed prior to the release of the Microsoft Patch. Although there is no confirmed active exploitation, publicly available exploit information increases the likelihood of opportunistic attacks.

Vulnerability Breakdown in the March Update

The March 2026 Microsoft Patch addresses multiple vulnerability categories. Elevation of Privilege vulnerabilities make up the largest portion of the update.

Vulnerability distribution:

• Denial of Service – 4
• Elevation of Privilege – 43
• Information Disclosure – 9
• Remote Code Execution – 16
• Security Feature Bypass – 2
• Spoofing – 4

This brings the total number of vulnerabilities fixed in the March Microsoft Patch release to 78.

Critical Vulnerabilities Patched

Three vulnerabilities received Microsoft’s highest Critical severity rating in this Microsoft Patch release.

• CVE-2026-26144 – Microsoft Excel Information Disclosure Vulnerability
• CVE-2026-26113 – Microsoft Office Remote Code Execution Vulnerability
• CVE-2026-26110 – Microsoft Office Remote Code Execution Vulnerability

The Office Remote Code Execution vulnerabilities could allow attackers to execute arbitrary code in the context of the current user if exploited.

Key Elevation of Privilege Vulnerabilities

Elevation of Privilege vulnerabilities represent the largest category in the March Microsoft Patch update.

Notable vulnerabilities include:

• CVE-2026-26132 – Windows Kernel Elevation of Privilege
• CVE-2026-26128 – Windows SMB Server Elevation of Privilege
• CVE-2026-25187 – Winlogon Elevation of Privilege
• CVE-2026-25189 – Windows DWM Core Library Elevation of Privilege
• CVE-2026-26148 – Azure AD SSH Login extension for Linux Elevation of Privilege

Cloud and Azure Related Fixes

Several cloud-related vulnerabilities were also addressed in this Microsoft Patch release.

These include:

• CVE-2026-26141 – Hybrid Worker Extension for Arc-enabled Windows VMs
• CVE-2026-26117 – Azure Connected Machine Agent
• CVE-2026-26118 – Azure MCP Server Tools

Each of these vulnerabilities could allow attackers to gain elevated privileges if successfully exploited.

Remote Code Execution Vulnerabilities

The March Microsoft Patch also resolves several Remote Code Execution vulnerabilities affecting enterprise infrastructure.

Important fixes include:

• CVE-2026-26114 – Microsoft SharePoint Server Remote Code Execution
• CVE-2026-26106 – Microsoft SharePoint Server Remote Code Execution
• CVE-2026-26111 – Windows Routing and Remote Access Service (RRAS)
• CVE-2026-25190 – Windows GDI Remote Code Execution

Four additional Excel Remote Code Execution vulnerabilities were patched:

• CVE-2026-26112
• CVE-2026-26109
• CVE-2026-26108
• CVE-2026-26107

Additional Security Fixes

Other vulnerabilities addressed in the March Microsoft Patch include:

• CVE-2026-26130 – ASP.NET Core Denial of Service
• CVE-2026-26131 – .NET Elevation of Privilege
• CVE-2026-26123 – Microsoft Authenticator Information Disclosure
• CVE-2026-26121 – Azure IoT Explorer Spoofing
• CVE-2026-26105 – SharePoint Spoofing
• CVE-2026-25188 – Windows Telephony Service Elevation of Privilege
• CVE-2026-25186 – Windows Accessibility Infrastructure Information Disclosure
• CVE-2026-26115 – SQL Server Elevation of Privilege
• CVE-2026-26116 – SQL Server Elevation of Privilege

Read More:

Xiaomi SU7 Ultra Owners Offered Free Hood Update After Advertising Dispute

The March 2026 Microsoft Patch release fixes 78 vulnerabilities across multiple Microsoft products, including one actively exploited zero-day vulnerability and several Critical flaws. Security teams are advised to prioritize deploying the Microsoft Patch update immediately, particularly for the SQL Server zero-day, critical Office vulnerabilities, Windows Kernel and SMB Server Elevation of Privilege issues, and SharePoint Remote Code Execution bugs. Prompt deployment of the Microsoft Patch remains essential to reduce security risks across affected environments.