Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days

Microsoft released patches for 84 security vulnerabilities in March 2026 Patch Tuesday, including two publicly known zero-days.

• •Two publicly disclosed zero-days: CVE-2026-26127 (DoS in .NET, CVSS 7.5) and CVE-2026-21262 (privilege escalation in SQL Server, CVSS 8.8)
• •The highest-severity flaw (CVE-2026-21536, CVSS 9.8) is a critical RCE in Microsoft Devices Pricing Program, already fully mitigated by Microsoft
• •55% of patched CVEs were privilege escalation bugs; six rated exploitation more likely across Windows Kernel, SMB Server, Winlogon, and other components
• •CVE-2026-26118 is an SSRF flaw in the Azure Model Context Protocol (MCP) server that could expose managed identity tokens to attackers over a network
• •CVE-2026-26144, an XSS-based information disclosure flaw in Excel, could allow Copilot Agent mode to silently exfiltrate data in a zero-click attack