Microsoft Patch Tuesday, March 2026 Edition
Summary: Microsoft released security updates addressing at least 77 vulnerabilities in Windows and other software, with no actively exploited zero-days this month compared to February's five. Two previously disclosed flaws were patched, including CVE-2026-21262, a SQL Server elevation-of-privilege bug rated CVSS 8.8 that allows an authorized attacker to reach sysadmin over a network, and CVE-2026-26127, a .NET flaw whose immediate impact is likely limited to denial of service.
What's compelling: Satnam Narang of Tenable notes that 55% of this month's Patch Tuesday CVEs are privilege escalation bugs, and a half dozen of those were rated 'exploitation more likely' across Windows Graphics Component, Accessibility Infrastructure, Kernel, SMB Server and Winlogon - all at CVSS 7.8.