Microsoft Patches 83 Vulnerabilities in March 2026 Update

Microsoft released its March 2026 Patch Tuesday security updates on Tuesday, addressing 83 vulnerabilities across its Windows operating system, Office applications, cloud services, and developer tools. The monthly update cycle, which occurs on the second Tuesday of each month, fixed flaws that could enable attackers to escalate privileges, execute code remotely, or disrupt services, though none have been confirmed as actively exploited in the wild.

Among the patches, two vulnerabilities qualified as publicly disclosed zero-days, meaning they were revealed before fixes were available but without evidence of real-world attacks. The first, CVE-2026-21262, is an elevation of privilege flaw in SQL Server that allows an authenticated attacker over a network to gain sysadmin-level access. Discovered by researcher Erland Sommarskog, it carries a CVSS score of 8.8 and requires low-level privileges for exploitation, which Microsoft rates as less likely to be targeted. The second, CVE-2026-26127, involves a denial-of-service condition in .NET caused by an out-of-bounds read, attributed to an anonymous researcher. Microsoft assesses this as unlikely to be exploited, as it demands...