Microsoft March 2026 Patch Tuesday Vulnerabilities Across SharePoint, Office/Excel, Windows Drivers, and GDI

Microsoft published security advisories for multiple Important and Critical vulnerabilities affecting SharePoint Server, Microsoft Office/Excel, Windows components, and GDI. The highest-impact server-side issue is CVE-2026-26114, a SharePoint Server remote code execution flaw attributed to CWE-502 (deserialization of untrusted data) with a CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N (base score shown as 8.8), indicating network reachability with low complexity and requiring low privileges. Microsoft also disclosed CVE-2026-26105, a SharePoint Server spoofing issue mapped to CWE-79 (XSS) with AV:N/AC:L/PR:N/UI:R (base score shown as 8.1), implying remote exploitation that requires user interaction.

On the endpoint/application side, Microsoft listed several Office/Excel remote code execution vulnerabilities: CVE-2026-26109 (Excel RCE; CWE-125 out-of-bounds read; vector AV:L/AC:L/PR:N/UI:N, base score shown as 8.4), CVE-2026-26108 (Excel RCE; CWE-122 heap-based buffer overflow; AV:L/AC:L/PR:N/UI:R, base score shown as 7.8), and CVE-2026-26112 (Excel RCE; CWE-822 untrusted pointer dereference; AV:L/AC:L/PR:N/UI:R, base score shown as 7.8). Microsoft also published CVE-2026-26113, a Critical Microsoft Office RCE (also CWE-822) with AV:L/AC:L/PR:N/UI:N (base score shown as 8.4); one reference is a duplicate advisory page for the same CVE. Additional component advisories include CVE-2026-24288 (Windows Mobile Broadband Driver RCE; CWE-122; AV:P/AC:L/PR:N/UI:N, base score shown as 6.8, requiring physical access) and CVE-2026-25190 (GDI RCE; CWE-426 untrusted search path; AV:L/AC:L/PR:N/UI:R, base score shown as 7.8).