Loading story…
Microsoft’s March 2026 Patch Tuesday shipped fixes for 79 vulnerabilities, including two zero-day flaws. Public reporting and third-party patch reviews highlight a mix of Important and Critical issues across Microsoft’s ecosystem, including .NET (CVE-2026-26127 DoS; CVE-2026-26131 EoP), Active Directory Domain Services (CVE-2026-25177 EoP), ASP.NET Core (CVE-2026-26130 DoS), and multiple Azure components such as ACI Confidential Containers (CVE-2026-23651, CVE-2026-26124 EoP; CVE-2026-26122 information disclosure) and Azure IoT Explorer (CVE-2026-26121 spoofing; CVE-2026-23661/23662/23664 information disclosure).
Independent analysis (ZDI and SANS ISC) corroborated the breadth of affected products and provided additional scoring/metadata, including CVSS ratings and exploitability flags. ZDI’s review also called out additional Critical items in the release such as Microsoft Office RCE (CVE-2026-26110, CVE-2026-26113) and other high-impact vulnerabilities, while SANS ISC’s Patch Tuesday coverage additionally noted bundled Chromium-tracked fixes (multiple CVE-2026-3536 through CVE-2026-3544 entries) that commonly map to Microsoft’s browser/embedded Chromium components. Organizations should prioritize patching systems exposed to untrusted content or authentication boundaries (e.g., Office, AD DS, Azure agents/extensions) and validate deployment coverage across both Windows and cloud-connected workloads.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Patch Tuesday coverage noted that SQL Server 2012 Parallel Data Warehouse would reach the end of extended support on March 31, 2026. This was highlighted as an important lifecycle milestone for organizations still running the product.
The March 2026 Patch Tuesday set also included notable high-severity vulnerabilities such as CVE-2026-21536 in Microsoft Devices Pricing Program and CVE-2026-26030 in Microsoft Semantic Kernel InMemoryVectorStore, along with multiple SharePoint, Office, Excel, RRAS, and Windows privilege-escalation flaws. These issues were identified as among the most severe bugs in the month's release.
Researchers highlighted CVE-2026-26123, an Important Microsoft Authenticator vulnerability on iOS and Android that could let a malicious app impersonate the legitimate Authenticator app by abusing a custom URL scheme handler. Commentary noted exploitation may require less user interaction than Microsoft's guidance suggested.
Security coverage of the March 2026 updates singled out CVE-2026-21262, a SQL Server elevation-of-privilege vulnerability that could allow an authorized attacker to gain sysadmin privileges over the network on supported SQL Server versions. Analysts emphasized the risk posed by internet-exposed SQL Server deployments.
The March 2026 release identified two publicly disclosed vulnerabilities: CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET. Multiple sources noted these were publicly disclosed at release time, while most reporting said there was no evidence of active exploitation.
On March 10, 2026, Microsoft released its March Patch Tuesday security updates covering roughly 77-79 vulnerabilities across Windows, Office, Azure, SQL Server, SharePoint, .NET, Edge, and related products. The release included a mix of Critical and Important flaws spanning remote code execution, elevation of privilege, denial of service, information disclosure, spoofing, and security feature bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
lansweeper.com
Open sourcethezdi.com
Open sourceisc.sans.edu
Open sourcebleepingcomputer.com
Open sourcezerodayinitiative.com
Open sourceisc.sans.edu
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its largest Patch Tuesday update to date, fixing **206 vulnerabilities** across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included **three publicly disclosed zero-days**, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw `CVE-2026-41091`. Publicly disclosed issues in the June bundle included `CVE-2026-50507`, a **BitLocker** security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and `CVE-2026-45586`, a **Windows CTFMON** elevation-of-privilege flaw that could let a low-privileged local attacker gain **SYSTEM** access. JPCERT/CC also warned that Microsoft disclosed active exploitation of `CVE-2026-42897`, a spoofing flaw in **Microsoft Exchange Server**.
Jul 3, 2026
Microsoft’s January Patch Tuesday security updates addressed **114 vulnerabilities**, including **three zero-days** reported as publicly known and/or exploited. Reported issues span multiple Windows and Microsoft product components, including **Desktop Window Manager (DWM)**, legacy modem drivers, and core OS services, with a mix of **information disclosure**, **elevation of privilege (EoP)**, **security feature bypass**, and **remote code execution (RCE)** flaws. Technical highlights called out include **CVE-2023-31096** (Windows Agere Soft Modem Driver EoP), **CVE-2026-20805** (DWM information disclosure), and a **Secure Boot certificate expiration** security feature bypass (**CVE-2026-21265**). The update set also includes multiple **Office/Excel/Word RCE** vulnerabilities (e.g., **CVE-2026-20952**, **CVE-2026-20953**, **CVE-2026-20955**, **CVE-2026-20957**, **CVE-2026-20944**), Windows privilege-escalation issues (e.g., **Windows Graphics Component** and **VBS Enclave** EoP), and cloud/agent components such as **Azure Connected Machine Agent** (**CVE-2026-21224**) and **Azure Core shared client library for Python** (**CVE-2026-21226**).
Jun 29, 2026
Microsoft released its June Patch Tuesday updates to address more than 200 vulnerabilities across Windows, .NET, Office, Teams, Exchange Server, Azure, Visual Studio Code, and other products, including three publicly disclosed zero-days: `CVE-2026-45586` in the Windows Collaborative Translation Framework (`CTFMON`), `CVE-2026-49160` in `HTTP.sys`, and `CVE-2026-50507` in Windows BitLocker. The update covered a broad range of impact types, including elevation of privilege, spoofing, denial of service, security feature bypass, information disclosure, and remote code execution, with notable high-severity issues such as `CVE-2026-44815`, a DHCP Client Service RCE flaw rated `CVSS 9.8`, and `CVE-2026-47281`, a Visual Studio Code elevation-of-privilege bug rated `CVSS 9.6`. Researchers described the release as part of a wider 2026 "patch tsunami," estimating roughly 198 to 208 Microsoft CVEs in the June cycle and about 571 CVEs overall when Chromium and other third-party issues were included, with 38 rated critical. One of the zero-days, `CVE-2026-49160`, was detailed as an `HTTP/2` and `HTTP/3` header compression flaw that can trigger resource exhaustion through a "compression bomb," and Microsoft added a `MaxHeadersCount` registry mitigation; the bug was reportedly credited to OpenAI Codex, underscoring claims that AI-assisted discovery is accelerating vulnerability reporting and increasing patch-management pressure on enterprises.
Jul 8, 2026