Particle.news
Download on the App Store
20 ARTICLES
·
4h ago

Microsoft’s March Patch Tuesday Fixes 80+ Flaws, Two Public Zero‑Days, No Active Exploits Reported

Administrators should prioritize EoP‑heavy fixes with heightened attention to Office preview attacks, Copilot‑driven data leaks, internet‑facing services.

Image
Image
Microsoft 365 app on Windows 11 with shortcuts to create documents in Word, PowerPoint, Excel, and other Microsoft 365 applications.
Image

Overview

  • Microsoft addressed roughly 79–84 CVEs across Windows, Office, .NET, SQL Server and Azure, with no vulnerabilities confirmed as actively exploited, marking the first month without active exploited zero‑days in six months.
  • Two previously disclosed issues were patched: CVE‑2026‑26127, a .NET denial‑of‑service bug, and CVE‑2026‑21262, a SQL Server elevation‑of‑privilege flaw that can grant sysadmin privileges.
  • Elevation‑of‑privilege dominated the release, with multiple bugs rated “exploitation more likely” in Windows Graphics, Kernel, SMB Server, Winlogon and the Accessibility Infrastructure.
  • A critical Excel bug, CVE‑2026‑26144, enables zero‑click data exfiltration by causing Copilot Agent mode to send data externally, while Office RCE flaws CVE‑2026‑26110 and CVE‑2026‑26113 can be triggered via the Preview Pane.
  • Microsoft said several cloud issues were mitigated server‑side, including the high‑severity Devices Pricing Program RCE (CVE‑2026‑21536), as advisories also flagged Azure MCP server token exposure risk (CVE‑2026‑26118) and ACI Confidential Containers fixes requiring no customer action.