Advertisement Advertisement Skip to content
Home About the Author Advertising/Speaking
Microsoft Patch Tuesday, March 2026 Edition
March 10, 2026 9 Comments
Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing ‘zero-day’ flaws this month (compared to February’s five zero-day treats), but as usual some patches may deserve more rapid attention from organizations using Windows.
Here are a few highlights from this month’s Patch Tuesday:
- Two of the bugs Microsoft patched today were publicly disclosed previously: CVE-2026-21262 and CVE-2026-26127. These include vulnerabilities in SQL Server 2016, .NET applications, and remote code execution flaws.
- Adam Barnett from Rapid7 noted that CVE-2026-21262 is a privilege escalation vulnerability with an CVSS v3 base score of 8.8, just below critical severity. It allows authorized attackers to elevate privileges to sysadmin over a network.
- CVE-2026-26127 in applications running on .NET is described by Barnett as having the immediate impact of potentially causing denial of service due to triggering a crash during service reboot.
- Satnam Narang at Tenable highlighted that 55% of this month’s Patch Tuesday CVEs are privilege escalation bugs, with half dozen rated ‘exploitation more likely’ across various components such as Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon.
- Ben McCarthy from Immersive brought attention to CVE-2026-21536, a critical remote code execution bug in the Microsoft Devices Pricing Program. This was discovered by an AI agent XBOW, which has consistently ranked at or near the top of Hacker One’s bug bounty leaderboard for the past year.
- In addition to these updates, Microsoft provided patches for nine browser vulnerabilities and released an out-of-band update for Windows Server 2022 on March 2 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.
Microsoft Patch Tuesday, March 2026 Edition
Summary: Microsoft released critical security updates on Patch Tuesday, March 2026, addressing 77 vulnerabilities in its Windows operating systems and other software. This update includes remote code execution flaws, privilege escalation bugs, and critical AI-driven discoveries.
Key facts
- 77 vulnerabilities fixed
- 55% privilege escalation bugs
- AI-driven vulnerability CVE-2026-21536
Why it matters
The release of critical security updates during this Patch Tuesday highlights the evolving landscape of cyber threats, emphasizing the importance of timely software patches in maintaining system security. The inclusion of AI-driven vulnerabilities underscores the increasing role of artificial intelligence in identifying and addressing complex security issues before they can be exploited.
Key metrics
- Number of Vulnerabilities: mathematically_77 (Total number of vulnerabilities addressed in the Patch Tuesday update)
- Percentage of Privilege Escalation Bugs: 55 % (Percentage of total CVEs that are privilege escalation bugs)