Microsoft March 2026 Patch Tuesday Fixes 83 Vulnerabilities, Focus on Privilege Escalation Bugs

 Satnam Narang, Sr. Staff Research Engineer, Tenable

“Microsoft’s third Patch Tuesday of 2026 includes fixes for 83 CVEs, including eight labelled critical. Neither of the two zero days patched this month was exploited, and their public disclosure prior to today is the only novel trait. They include CVE-2026-26127, a denial-of-service vulnerability in .NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. These bugs are more bark than bite. The DoS vulnerability is assessed as unlikely to be exploited and requires an attacker to be authorised beforehand, while the privilege escalation bug was deemed less likely to be exploited. 

“This month, over half (55%) of all Patch Tuesday CVEs were privilege escalation bugs, and of those, six were rated exploitation more likely across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. We know these bugs are typically used by threat actors as part of post-compromise activity, once they get onto systems through other means (social engineering, exploitation of another vulnerability).

“This month, Microsoft also patched CVE-2026-26118, an elevation of privilege vulnerability in Azure Model Context Protocol (MCP) tools. This bug is a server-side request forgery, so an attacker could exploit it by sending a request to a vulnerable Azure MCP Server, but exploitation requires that the server accept user-provided parameters. MCP servers have become extremely popular for connecting large language models and agentic AI applications, and with the rise of tools like OpenClaw and other agents, it has become even more critical to secure these tools from cybercriminals.”