Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days
Summary: Microsoft released patches for 84 new security vulnerabilities on Tuesday, including eight rated Critical and 76 rated Important, with 46 of them privilege escalation flaws, 18 remote code execution, 10 information disclosure, four spoofing, four denial-of-service, and two security feature bypass issues. The two publicly known zero-days are CVE-2026-26127 (CVSS 7.5), a denial-of-service flaw in .NET, and CVE-2026-21262 (CVSS 8.8), an elevation of privilege flaw in SQL Server, while the highest-scoring issue is CVE-2026-21536 (CVSS 9.8), a critical remote code execution flaw in the Microsoft Devices Pricing Program that Microsoft says is fully mitigated.
What you should know: The Winlogon privilege escalation flaw CVE-2026-25187 requires no user interaction and has low attack complexity, letting a locally authenticated low-privilege attacker reach SYSTEM once they have a foothold, and the Azure MCP server SSRF bug CVE-2026-26118 can leak a managed identity token to an attacker who submits a malicious URL through an MCP-backed agent.