Microsoft March 2026 Patch Tuesday: 84 Flaws Fixed Including Two Zero-Days, a CVSS 9.8 RCE, and a Zero-Click Copilot Data Leak

The two publicly disclosed zero-days are CVE-2026-26127, a denial of service vulnerability in .NET caused by an out-of-bounds read that allows an unauthenticated remote attacker to crash .NET-based applications over a network, and CVE-2026-21262, an elevation of privilege flaw in SQL Server that allows an authenticated attacker to escalate their access all the way to full sysadmin privileges on the database server. Neither has been confirmed as actively exploited at the time of release, but public disclosure means attackers are already aware of both and will be moving to weaponize them quickly. The most severe vulnerability in the entire update is CVE-2026-21536, a CVSS 9.8 remote code execution flaw in the Microsoft Devices Pricing Program that required no privileges or user interaction to exploit — however Microsoft has already fully mitigated this on their end and no action is needed from users. Notably, this is one of the first vulnerabilities officially attributed to a CVE discovered by an AI agent rather than a human researcher.

The flaw that deserves the most attention from enterprise security teams is CVE-2026-26144 in Microsoft Excel. This cross-site scripting vulnerability could allow an attacker who exploited it to cause Copilot Agent mode to silently exfiltrate data from inside the application as a zero-click attack — meaning no user action beyond opening or previewing a document is required. In corporate environments where Excel files routinely contain financial records, intellectual property, and operational data, this is a serious exposure. Organizations using AI-assisted productivity features face heightened risk because automated agents could transmit sensitive data outside corporate boundaries without triggering obvious alerts. The two Microsoft Office remote code execution flaws — CVE-2026-26110 and CVE-2026-26113 — are equally urgent because both can be triggered simply by viewing a malicious document in the Preview Pane, without the user ever fully opening the file. The Winlogon privilege escalation flaw CVE-2026-25187 allows a locally authenticated attacker with low privileges to escalate to SYSTEM level through a link-following vulnerability, requiring no user interaction and rated as low attack complexity — meaning once an attacker has any foothold on a machine, this is a straightforward path to full control.