Security Bulletin

March 10th, 2026

Overview:

Microsoft’s March 10, 2026 Patch Tuesday addressed ~83 vulnerabilities, including two publicly disclosed zero-days and three to eight critical issues, depending on whether you count Microsoft Edge/Chromium and cloud-service issues that were patched outside the main same-day CVE set. No March vulnerabilities were confirmed as actively exploited at release.

Vulnerability Category Breakdown:

• Elevation of Privilege (EoP): ~46 vulnerabilities (~55%)

• Remote Code Execution (RCE): ~17–18 vulnerabilities (~21%)

• Information Disclosure: ~10 vulnerabilities

• Security Feature Bypass: ~2 vulnerabilities

• Denial of Service (DoS): ~4 vulnerabilities

• Spoofing: ~4 vulnerabilities

Top 5:

1) CVE-2026-21262: SQL Server Elevation of Privilege (Publicly disclosed / zero-day)

• Why it matters: This was publicly disclosed before a patch was available. A successful exploit can let an authorized attacker gain SQL sysadmin privileges, which is the sort of thing that makes database admins spill coffee on their keyboards.

• Affected systems: Microsoft SQL Server deployments.

• Pivotalogic Priority Rating: 💥SHUT IT DOWN - Patch ASAP, especially for production SQL Server instances and systems exposed to multiple internal users or application tiers.

2) CVE-2026-26127: .NET Denial of Service (Publicly disclosed / zero-day)

• Why it matters: This flaw was also publicly disclosed before patch availability. Microsoft says exploitation is unlikely, but it is network exploitable and affects a broad cross-platform footprint, so it is still worth moving quickly on in modern app environments.

• Affected systems: .NET 9.0 and 10.0 on Windows, macOS, and Linux.

• Pivotalogic Priority Rating: 💥SHUT IT DOWN - Patch ASAP, with priority on internet-facing apps and shared application platforms

  
  

3) CVE-2026-26110 & CVE-2026-26113: Microsoft Office Remote Code Execution (RCE)

• Why it matters: These are critical Office RCEs, and the Preview Pane is an attack vector, meaning the user may not need to fully open the document for the exploit path to trigger. That is classic Patch Tuesday gremlin behavior.

• Affected systems: Microsoft Office installations on user endpoints and other systems where Office is installed.

• Pivotalogic Priority Rating: 💥SHUT IT DOWN - Patch immediately, on user workstations, shared admin systems, and any environment with regular inbound document handling.

4) CVE-2026-26144: Microsoft Excel Information Disclosure

• Why it matters: This one stands out because Microsoft says it could allow Copilot Agent mode to exfiltrate data via unintended network egress, enabling a zero-click information disclosure scenario. That is not a sentence defenders enjoy reading.

• Affected systems: Microsoft Excel / Microsoft Office Excel environments, especially where Microsoft Copilot features are in use.

• Pivotalogic Priority Rating: 🚨Yikes! - Patch within 72 hours, particularly for organizations using Copilot-enabled Microsoft 365 workflows or handling sensitive spreadsheet data.

5) CVE-2026-24289 & CVE-2026-26132: Windows Kernel Elevation of Privilege

• Why it matters: These kernel EoP flaws can let a local authenticated attacker gain SYSTEM privileges, and Microsoft assessed both as “Exploitation More Likely.” That makes them prime candidates for post-compromise chaining.

• Affected systems: Windows clients and servers.

• Pivotalogic Priority Rating: 🚨Yikes! - Patch within 72 hours, for higher-risk systems and as soon as practical across the broader Windows fleet.

Pivotalogic Priority Rating Scale: 

💥SHUT IT DOWN (not literally) = Critical

🚨Yikes! = High

⚠️Welp. = Medium

💡Eh = Low

Full Microsoft Release Notes HERE