Loading story…
Microsoft released its March 2026 Patch Tuesday security updates addressing vulnerabilities across a broad set of products, and the Canadian Centre for Cyber Security issued advisory AV26-213 urging organizations to review Microsoft’s guidance and apply the required patches. The advisory highlights updates spanning Windows (10/11 and multiple Windows Server versions), .NET/ASP.NET Core, Microsoft 365, Office/Excel, SharePoint, SQL Server, and multiple Azure-related components and extensions (including Azure Arc/Connected Machine Agent and other Windows/Linux extensions), reflecting a wide attack surface for enterprise environments.
Arctic Wolf’s Patch Tuesday coverage calls out specific fixes affecting Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, including CVE-2026-26113, and also notes Office-family updates addressing CVE-2026-26110 and CVE-2026-26113 across Office 2016/2019, Office LTSC 2021/2024 (including Mac), and Office for Android, with referenced KB updates (e.g., 5002843, 5002845, 5002847, 5002850, 5002851, 5002838). Together, the sources indicate that organizations running SharePoint and Office (including Click-to-Run deployments) should prioritize patch validation and deployment using Microsoft’s Security Update Guide and the March 2026 security update listings referenced by the Cyber Centre.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-11, additional reporting identified specific products affected by March 2026 Patch Tuesday vulnerabilities, notably CVE-2026-26113, CVE-2026-26110, and CVE-2026-26144. The reporting mapped SharePoint Server, multiple Microsoft Office editions, and Microsoft 365 Apps for Enterprise to corresponding KBs, Click-to-Run updates, and release notes.
On 2026-03-10, Microsoft published its March 2026 monthly security advisories covering vulnerabilities across multiple products and services, including Windows, .NET/ASP.NET Core, Office, SharePoint, SQL Server, and Azure components. The advisories directed users and administrators to review the Security Update Guide and apply the relevant patches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Aug 10, 2026
Microsoft published security advisories for multiple **Important** and **Critical** vulnerabilities affecting *SharePoint Server*, *Microsoft Office/Excel*, Windows components, and *GDI*. The highest-impact server-side issue is **CVE-2026-26114**, a *SharePoint Server* **remote code execution** flaw attributed to **CWE-502 (deserialization of untrusted data)** with a CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N` (base score shown as 8.8), indicating network reachability with low complexity and requiring low privileges. Microsoft also disclosed **CVE-2026-26105**, a *SharePoint Server* **spoofing** issue mapped to **CWE-79 (XSS)** with `AV:N/AC:L/PR:N/UI:R` (base score shown as 8.1), implying remote exploitation that requires user interaction. On the endpoint/application side, Microsoft listed several *Office/Excel* **remote code execution** vulnerabilities: **CVE-2026-26109** (Excel RCE; **CWE-125 out-of-bounds read**; vector `AV:L/AC:L/PR:N/UI:N`, base score shown as 8.4), **CVE-2026-26108** (Excel RCE; **CWE-122 heap-based buffer overflow**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8), and **CVE-2026-26112** (Excel RCE; **CWE-822 untrusted pointer dereference**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8). Microsoft also published **CVE-2026-26113**, a **Critical** *Microsoft Office* RCE (also **CWE-822**) with `AV:L/AC:L/PR:N/UI:N` (base score shown as 8.4); one reference is a duplicate advisory page for the same CVE. Additional component advisories include **CVE-2026-24288** (Windows Mobile Broadband Driver RCE; **CWE-122**; `AV:P/AC:L/PR:N/UI:N`, base score shown as 6.8, requiring physical access) and **CVE-2026-25190** (GDI RCE; **CWE-426 untrusted search path**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8).
Jul 12, 2026
Microsoft released its largest Patch Tuesday update on record, fixing roughly **570 to 622 Microsoft CVEs** across Windows, Office, SharePoint Server, Exchange Server, SQL Server, Edge, Azure, Defender, and developer tools. The release included **three zero-days**, with **CVE-2026-56155** in **Active Directory Federation Services (AD FS)** and **CVE-2026-56164** in **on-premises Microsoft SharePoint Server** confirmed as exploited in the wild, while **CVE-2026-50661** patched a publicly disclosed **BitLocker** security feature bypass requiring physical access. Microsoft and multiple security outlets said the surge in findings was partly driven by AI-assisted vulnerability discovery, while the broader update also addressed dozens of critical remote code execution flaws in services such as DHCP, Hyper-V, Office, Exchange, SQL Server, Copilot, and SharePoint. U.S. agencies and industry groups elevated the urgency around SharePoint after CISA warned that attackers were actively exploiting **CVE-2026-56164** alongside **CVE-2026-32201** and **CVE-2026-45659** against internet-exposed on-premises servers, enabling unauthorized access, remote code execution, theft of IIS machine keys, persistence, and malware deployment. CISA added the exploited AD FS and SharePoint flaws to its **Known Exploited Vulnerabilities** catalog and urged immediate remediation, while Microsoft recommended SharePoint hardening measures including **AMSI integration with full request body scanning** and stronger Defender protections; exposed identity systems, SharePoint farms, and other internet-facing Microsoft services were identified as the highest-priority patch targets.
Jul 24, 2026