endpoint-software-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Microsoft Patch Tuesday Fixes Critical Office Preview Pane RCE Flaws

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 12, 2026

Microsoft released March Patch Tuesday security updates addressing nearly 80 vulnerabilities, including critical Microsoft Office remote code execution issues that can be triggered via the Windows Preview Pane. TechRepublic highlighted two Office flaws—CVE-2026-26113 and CVE-2026-26110—where simply previewing a malicious document can lead to attacker-controlled code execution, creating a low-friction initial access path for enterprise endpoints.

Cybersecurity News provided additional technical detail on CVE-2026-26110, describing it as a type confusion bug (CWE-843) with a CVSS 8.4 rating affecting Office across Windows, macOS, and Android. The write-up notes that while Microsoft labels it “remote code execution,” exploitation requires the payload to execute on the local machine (i.e., attacker code runs locally after the victim triggers the vulnerable processing), and emphasizes the risk that Preview Pane handling can enable compromise without the user opening the document in the traditional sense.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Mar 10, 2026

Mar 10, 20268mo ago
Microsoft discloses Excel flaw that could leak Copilot Agent data
Microsoft's March Patch Tuesday release included CVE-2026-26144, an Excel information disclosure vulnerability that could cause Copilot Agent mode to expose sensitive data across a network. The issue was included among the March 10 security fixes.
Mar 10, 20268mo ago
Microsoft patches AI-discovered Devices Pricing Program vulnerability
Microsoft fixed CVE-2026-21536, a CVSS 9.8 vulnerability affecting the Microsoft Devices Pricing Program. The flaw was reportedly discovered by an autonomous AI agent named XBOW.
Mar 10, 20268mo ago
Microsoft addresses publicly disclosed SQL Server and .NET flaws
The March 2026 updates also remediated two publicly disclosed vulnerabilities: SQL Server privilege escalation CVE-2026-21262 and .NET denial-of-service issue CVE-2026-26127. Their prior public disclosure increased urgency because technical details may already have been available.
Mar 10, 20268mo ago
Microsoft patches critical Office Preview Pane RCE vulnerabilities
Microsoft fixed high-priority Office remote code execution flaws CVE-2026-26110 and CVE-2026-26113, which can be triggered through the Windows File Explorer Preview Pane by viewing a malicious document. Microsoft advised immediate patching and suggested disabling the Preview Pane as a temporary mitigation if updates cannot be applied right away.
Mar 10, 20268mo ago
Microsoft releases March Patch Tuesday fixes for 78 vulnerabilities
On March 10, 2026, Microsoft issued security updates covering 78 vulnerabilities across products including Office, Excel, SQL Server, .NET, and the Microsoft Devices Pricing Program. The release included three critical issues and no actively exploited zero-days.
Mar 10, 20268mo ago
Anonymous researcher discloses Office RCE flaw CVE-2026-26110 to Microsoft
An anonymous researcher reported CVE-2026-26110, a type confusion vulnerability in Microsoft Office that can lead to arbitrary code execution. Microsoft said there was no known in-the-wild exploitation or proven exploit code at the time of disclosure.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Microsoft Office Type Confusion Remote Code Execution Vulnerability (CVE-2026-26110)Microsoft Office Preview Pane Remote Code Execution Vulnerability (CVE-2026-26113)

Affected products

1 linked

Microsoft Office

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Mar 12, 2026

Critical Microsoft Office Vulnerability Enables Remote Code Execution AttacksOpen source ↗

Techrepublic Com SecurityNews · Mar 11, 2026

Patch Alert: Microsoft Fixes Nearly 80 Bugs, Including Critical Office FlawsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Microsoft Patch Tuesday Fixes Critical Office Preview Pane RCE Flaws

How this story unfolded

Microsoft discloses Excel flaw that could leak Copilot Agent data

Microsoft patches AI-discovered Devices Pricing Program vulnerability

Microsoft addresses publicly disclosed SQL Server and .NET flaws

Microsoft patches critical Office Preview Pane RCE vulnerabilities

Microsoft releases March Patch Tuesday fixes for 78 vulnerabilities

Anonymous researcher discloses Office RCE flaw CVE-2026-26110 to Microsoft

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Patches Critical Office and Outlook Preview Pane RCE Flaws

Microsoft Office Preview Pane Flaw Enables Zero-Click Remote Code Execution

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps

Microsoft Patch Tuesday Fixes Critical Office Preview Pane RCE Flaws

How this story unfolded

Microsoft discloses Excel flaw that could leak Copilot Agent data

Microsoft patches AI-discovered Devices Pricing Program vulnerability

Microsoft addresses publicly disclosed SQL Server and .NET flaws

Microsoft patches critical Office Preview Pane RCE vulnerabilities

Microsoft releases March Patch Tuesday fixes for 78 vulnerabilities

Anonymous researcher discloses Office RCE flaw CVE-2026-26110 to Microsoft

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Patches Critical Office and Outlook Preview Pane RCE Flaws

Microsoft Office Preview Pane Flaw Enables Zero-Click Remote Code Execution

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps